Merge pull request #26655 from containers/renovate/common-image-and-storage-deps

fix(deps): update module github.com/containers/common to v0.64.0

.cirrus.yml

@@ -31,7 +31,7 @@ env:
     DEBIAN_NAME: "debian-13"
 
     # Image identifiers
-    IMAGE_SUFFIX: "c20250422t130822z-f42f41d13"
+    IMAGE_SUFFIX: "c20250627t155202z-f42f41d13"
 
     # EC2 images
     FEDORA_AMI: "fedora-aws-${IMAGE_SUFFIX}"
@@ -856,6 +856,8 @@ podman_machine_windows_task:
         Get-Volume
     main_script: ".\\repo\\contrib\\cirrus\\win-podman-machine-main.ps1"
     always:
+        wsl_logs_artifacts:
+            path: ./*.zip
         # Required for `contrib/cirrus/logformatter` to work properly
         html_artifacts:
             path: ./*.html

.github/workflows/dev-bump.yml

@@ -0,0 +1,158 @@
+name: Bump to -dev version
+on:
+  push:
+    tags:
+      - '*'
+jobs:
+  bump:
+    name: Bump to -dev
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.ref_name }}
+          token: ${{ secrets.PODMANBOT_TOKEN }}
+      - name: Bump
+        id: bump
+        run: |
+          ref=${{ github.ref_name }}
+          version=${ref#v}
+          if [[ $version == *-rc* ]]; then
+              devbump="${version%-*}-dev"
+              echo "::notice:: is a rc - bumping z down to $devbump"
+          else
+              arr=($(echo "$version" | tr . '\n'))
+              arr[2]=$((${arr[2]}+1))
+              devbump="$(IFS=. ; echo "${arr[*]}")-dev"
+              echo "::notice:: bumping z up to $devbump"
+          fi
+
+          sed -i "s/const RawVersion = ".*"/const RawVersion = \"${devbump}\"/g" version/rawversion/version.go
+
+          echo "devbump=$devbump" >> $GITHUB_OUTPUT
+      - name: Push
+        run: |
+          # Make committer the user who triggered the action, either through cutting a release or manual trigger
+          # GitHub gives everyone a noreply email associated with their account, use that email for the sign-off
+          git config --local user.name ${{ github.actor }}
+          git config --local user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+          bumpbranch="bump-${{ steps.bump.outputs.devbump }}"
+          git checkout -b $bumpbranch
+          git add version/rawversion/version.go
+          git commit --signoff -m "Bump Podman to v${{ steps.bump.outputs.devbump }}"
+          git remote add podmanbot https://github.com/podmanbot/podman
+          git push -f podmanbot "$bumpbranch"
+      - name: Check open PRs
+        id: checkpr
+        env:
+          GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}
+        run: |
+          prs=$(gh pr list \
+            --repo ${{ github.repository }} \
+            --head bump-${{ steps.bump.outputs.devbump }} \
+            --state open \
+            --json title \
+            --jq 'length')
+          if ((prs > 0)); then
+            echo "SKIPPING: PR already exists to update from ${{ github.ref_name }}."
+          else
+            echo "prexists=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Open PR
+        if: steps.checkpr.outputs.prexists == 'false'
+        id: pr
+        run: |
+          bumpbranch="bump-${{ steps.bump.outputs.devbump }}"
+          ref=${{ github.ref_name }}
+          base=${ref%.*}
+          body=$(printf '```release-note\nNone\n```\n')
+          gh pr create \
+            --title "Bump Podman to v${{ steps.bump.outputs.devbump }}" \
+            --body  "$body" \
+            --head "podmanbot:$bumpbranch" \
+            --base "$base" \
+            --repo ${{ github.repository }}
+        env:
+          GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}
+  mainbump:
+    name: Bump on main
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: main
+          token: ${{ secrets.PODMANBOT_TOKEN }}
+      - name: Check version on main
+        id: check
+        run: |
+          mainvers=`grep -P '(?<=const RawVersion = ")(\d.\d)' -o version/rawversion/version.go`
+          ref=${{ github.ref_name }}
+          releasevers=${ref#v}
+          if echo "${mainvers},${releasevers}" | tr ',' '\n' | sort -V -C
+          then
+              echo "bump=true" >> $GITHUB_OUTPUT
+              echo "Main is lower than release, so we need to bump main"
+          else
+              echo "::notice:: SKIPPING: Main is higher than release, no need to bump"
+          fi
+      - name: Bump main
+        id: bump
+        if: steps.check.outputs.bump == 'true'
+        run: |
+          ref=${{ github.ref_name }}
+          releasevers=${ref#v}
+
+          arr=($(echo "$releasevers" | tr . '\n'))
+          arr[1]=$((${arr[1]}+1))
+          arr[2]=0
+          devbump="$(IFS=. ; echo "${arr[*]}")-dev"
+          echo "::notice:: Bumping main to: $devbump"
+
+          sed -i "s/const RawVersion = \".*\"/const RawVersion = \"$devbump\"/g" version/rawversion/version.go
+
+          echo "devbump=$devbump" >> $GITHUB_OUTPUT
+      - name: Push
+        if: steps.check.outputs.bump == 'true'
+        run: |
+          # Make committer the user who triggered the action, either through cutting a release or manual trigger
+          # GitHub gisves everyone a noreply email associated with their account, use that email for the sign-off
+          git config --local user.name ${{ github.actor }}
+          git config --local user.email "${{ github.actor_id }}+${{ github.actor }}@users.noreply.github.com"
+          bumpbranch="bump-main-${{ steps.bump.outputs.devbump }}"
+          git checkout -b $bumpbranch
+          git add version/rawversion/version.go
+          git commit --signoff -m "Bump main to v${{ steps.bump.outputs.devbump }}"
+          git remote add podmanbot https://github.com/podmanbot/podman
+          git push -f podmanbot "$bumpbranch"
+      - name: Check open PRs
+        id: checkpr
+        if: steps.check.outputs.bump == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}
+        run: |
+          prs=$(gh pr list \
+            --repo ${{ github.repository }} \
+            --head bump-main-${{ steps.bump.outputs.devbump }} \
+            --state open \
+            --json title \
+            --jq 'length')
+          if ((prs > 0)); then
+            echo "SKIPPING: PR already exists to update to ${{ steps.bump.outputs.devbump }}."
+          else
+            echo "prexists=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Open PR
+        if: steps.check.outputs.bump == 'true' &&  steps.checkpr.outputs.prexists == 'false'
+        run: |
+          bumpbranch="bump-main-${{ steps.bump.outputs.devbump }}"
+          body=$(printf '```release-note\nNone\n```\n')
+          gh pr create \
+            --title "Bump main to v${{ steps.bump.outputs.devbump }}" \
+            --body  "$body" \
+            --head "podmanbot:$bumpbranch" \
+            --base "main" \
+            --repo ${{ github.repository }}
+        env:
+          GH_TOKEN: ${{ secrets.PODMANBOT_TOKEN }}

.github/workflows/fcos-podman-next-build.yml

@@ -1,97 +0,0 @@
-name: Build FCOS image with packages from rhcontainerbot/podman-next
-
-on:
-  push:
-    branches:
-      - main
-  # Run everyday at midnight and pull the latest packages from the copr
-  schedule:
-    - cron: '0 0 * * *'
-
-env:
-  IMAGE_NAME: fcos
-  # IMAGE_ARCHS has to be comma separated
-  IMAGE_ARCHS: amd64, arm64
-  IMAGE_REGISTRY: quay.io/podman
-  COPR_OWNER: rhcontainerbot
-  COPR_PROJECT: podman-next
-
-jobs:
-  fcos-podman-next-image-build:
-    runs-on: ubuntu-latest
-
-    steps:
-    - name: Install qemu dependency
-      run: |
-        sudo apt update
-        sudo apt -y install qemu-user-static
-
-    - name: Set up wait-for-copr
-      # Do not run on scheduled nightly builds
-      if: ${{ github.event_name != 'schedule' }}
-      run: |
-        pip3 install git+https://github.com/packit/wait-for-copr.git@main
-
-    - name: Check out code
-      uses: actions/checkout@v4
-
-    - name: Get short SHA from HEAD
-      run: echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
-      id: short_sha
-
-    - name: Wait for successful podman-next build with the latest commit
-      # Do not run on scheduled nightly builds
-      if: ${{ github.event_name != 'schedule' }}
-      run: |
-        # TODO: add this in the Containerfile itself or as a --build-arg
-        wait-for-copr --owner ${{ env.COPR_OWNER }} --project ${{ env.COPR_PROJECT }} podman ${{ env.SHORT_SHA }}
-        echo "podman-next build successful."
-
-    - name: Build FCOS Image
-      id: build_image_multiarch
-      # Ref: https://github.com/redhat-actions/buildah-build
-      uses: redhat-actions/buildah-build@v2
-      with:
-        image: ${{ env.IMAGE_NAME }}
-        tags: ${{ env.COPR_PROJECT }} podman-${{ env.SHORT_SHA }}
-        archs: ${{ env.IMAGE_ARCHS }}
-        containerfiles: ./contrib/podman-next/fcos-podmanimage/Containerfile
-        labels: |
-          org.opencontainers.image.title=fcos-podman-next image
-          org.opencontainers.image.source=https://raw.githubusercontent.com/${{ github.repository }}/${{ github.sha }}/contrib/podman-next/fcos-podmanimage/Containerfile
-          org.opencontainers.image.url=https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          org.opencontainers.image.description=FCOS image with rpms from rhcontainerbot/podman-next copr
-          org.opencontainers.image.revision=${{ github.sha }}
-
-
-    - name: Echo Outputs
-      run: |
-        echo "Image: ${{ steps.build_image_multiarch.outputs.image }}"
-        echo "Tags: ${{ steps.build_image_multiarch.outputs.tags }}"
-        echo "Tagged Image: ${{ steps.build_image_multiarch.outputs.image-with-tag }}"
-
-    - name: Check images created
-      run: buildah images | grep '${{ env.IMAGE_NAME }}'
-
-    - name: Check image metadata
-      run: |
-        set -x
-        # COPR_PROJECT envvar is used for the `podman-next` floating tag
-        buildah inspect ${{ steps.build_image_multiarch.outputs.image }}:${{ env.COPR_PROJECT }} | jq ".OCIv1.architecture"
-        buildah inspect ${{ steps.build_image_multiarch.outputs.image }}:${{ env.COPR_PROJECT }} | jq ".Docker.architecture"
-        buildah inspect ${{ steps.build_image_multiarch.outputs.image }}:podman-${{ env.SHORT_SHA }} | jq ".OCIv1.architecture"
-        buildah inspect ${{ steps.build_image_multiarch.outputs.image }}:podman-${{ env.SHORT_SHA }} | jq ".Docker.architecture"
-
-    - name: Run image
-      run: podman run --privileged --rm ${{ steps.build_image_multiarch.outputs.image-with-tag }} podman system info
-
-    - name: Push to Quay
-      id: push-to-quay
-      # Ref: https://github.com/redhat-actions/push-to-registry
-      uses: redhat-actions/push-to-registry@v2
-      with:
-        image: ${{ env.IMAGE_NAME }}
-        tags: ${{ steps.build_image_multiarch.outputs.tags }}
-        registry: ${{ env.IMAGE_REGISTRY }}
-        username: ${{ secrets.QUAY_PODMAN_USERNAME }}
-        password: ${{ secrets.QUAY_PODMAN_PASSWORD }}

.github/workflows/machine-os-pr.yml

@@ -2,11 +2,6 @@ name: "Machine OS PR"
 
 on:
   pull_request_target:
-    # prevent action from running on older release-process branches
-    # TODO: remove when we move to new release flow
-    branches:
-      - 'v5.5'
-      - 'main'
     paths:
       - 'version/rawversion/version.go'
 
@@ -32,10 +27,15 @@ jobs:
       - name: Get version
         id: getversion
         run: |
-          VERSION=$(curl "https://raw.githubusercontent.com/$PODMAN_REPO/$SHA/version/rawversion/version.go" | sed -n 's/^const RawVersion = \"\(.*\)\"$/\1/p')
+          VERSION=$(curl "https://raw.githubusercontent.com/$PODMAN_REPO/$SHA/version/rawversion/version.go" | sed -n 's/^const RawVersion = \"\([0-9]\+\.[0-9]\+\.[0-9]\+\(-rc[0-9]\+\|-dev\)\?\)"$/\1/p')
           # ignore -dev version bumps unless on main
-          if [[ ${{github.base_ref}} != "main" ]] && [[ $VERSION == *-dev ]] ; then
-            echo "::warning:: SKIPPING: dev bump not on main"
+          if [[ -z "$VERSION" ]] ; then
+            echo "::error:: Invalid version string"
+            exit 1
+          elif [[ $VERSION == *-dev ]] ; then
+            echo "::warning:: SKIPPING: dev bump"
+          elif [[ ${{github.base_ref}} == "main" ]] ; then
+            echo "::warning:: SKIPPING: main branch"
           elif [[ ${{github.base_ref}} == *-rhel ]] ; then
             echo "::warning:: SKIPPING: rhel branch"
           else
@@ -75,9 +75,11 @@ jobs:
 
       - name: Bump version
         if: steps.getversion.outputs.update == 'true'
+        env:
+          VERS: ${{steps.getversion.outputs.version}}
         run: |
-          echo ${{steps.getversion.outputs.version}}
-          sed -i 's/export PODMAN_VERSION=".*"/export PODMAN_VERSION="${{steps.getversion.outputs.version}}"/g' podman-rpm-info-vars.sh
+          update=$(printf 's/export PODMAN_VERSION=".*"/export PODMAN_VERSION="%s"/g\n' "$VERS")
+          sed -i "$update" podman-rpm-info-vars.sh
           sed -i 's/export PODMAN_PR_NUM=".*"/export PODMAN_PR_NUM="${{github.event.number}}"/g' podman-rpm-info-vars.sh
           echo "Updated file:"
           cat podman-rpm-info-vars.sh
@@ -128,9 +130,11 @@ jobs:
         id: pr
         run: |
           bumpbranch="pr${{github.event.number}}"
+          body=$(printf 'Triggered by https://github.com/%s/pull/%s\n\n```release-note\nRelease v%s\n```\n' \
+          "$PODMAN_REPO" "${{github.event.number}}" "${{ steps.getversion.outputs.version }}")
           uri=`gh pr create \
             --title "Bump Podman to v${{ steps.getversion.outputs.version }}" \
-            --body  "Triggered by https://github.com/$PODMAN_REPO/pull/${{github.event.number}}" \
+            --body  "$body" \
             --head "podmanbot:$bumpbranch" \
             --base "${{github.base_ref}}" \
             --repo $UPSTREAM_MACHINE_OS`

.github/workflows/pr-title.yml

@@ -1,24 +0,0 @@
-# Upstream: github.com/tzkhan/pr-update-action
-
-name: "PR title check"
-
-on:
-  pull_request_target:
-    branches:
-      - "!master"   # causes errors; reason unknown
-
-permissions:
-  contents: read
-
-jobs:
-  update_pr:
-    permissions:
-      pull-requests: write  # for tzkhan/pr-update-action to update PRs
-    runs-on: ubuntu-latest
-    steps:
-    - uses: tzkhan/pr-update-action@bbd4c9395df8a9c4ef075b8b7fe29f2ca76cdca9 # v2
-      with:
-        repo-token: "${{ secrets.GITHUB_TOKEN }}"
-        base-branch-regex: '^(?!master).*$'
-        title-template: '[%basebranch%]'
-        title-prefix-space: true

.github/workflows/release.yml

@@ -144,6 +144,9 @@ jobs:
 
   windows-installer:
     name: Build Windows Installer
+    strategy:
+      matrix:
+        arch: [amd64, arm64]
     runs-on: windows-latest
     needs: [check, build-artifacts]
     env:
@@ -198,13 +201,29 @@ jobs:
         }
         Pop-Location
         Exit $code
-    - name: Display structure of downloaded files
+      env:
+        PODMAN_ARCH: ${{ matrix.arch }}
+    - name: Display structure of built files
       run: |
         Push-Location contrib\win-installer
         Get-ChildItem
         Pop-Location
-    - name: Artifact
+    - name: Rename the installer
+      run: |
+        Push-Location contrib\win-installer
+        Copy-Item -Path podman-${{steps.getversion.outputs.version}}-setup.exe -Destination podman-installer-windows-${{ matrix.arch }}.exe
+        Pop-Location
+    - name: Upload the installer
       uses: actions/upload-artifact@v4
+      with:
+        name: win-installer-${{ matrix.arch }}
+        path: |
+          .\contrib\win-installer\podman-installer-windows-${{ matrix.arch }}.exe
+      # For backwards compatibility, we also upload the amd64 windows
+      # installer using the old name
+    - name: Upload the installer (legacy)
+      uses: actions/upload-artifact@v4
+      if: ${{ matrix.arch == 'amd64' }}
       with:
         name: win-installer
         path: |
@@ -245,6 +264,8 @@ jobs:
       run: |
         mv win-installer/* release-artifacts
         mv mac-installers/* release-artifacts
+        mv win-installer-amd64/* release-artifacts
+        mv win-installer-arm64/* release-artifacts
         pushd release-artifacts
         sha256sum * > shasums
         popd
@@ -324,3 +345,12 @@ jobs:
           to: Podman List <podman@lists.podman.io>
           from: ${{secrets.ACTION_MAIL_SENDER}}
           body: file://./email_body.txt
+
+  updatepodmanio:
+    name: Update podman.io
+    uses: ./.github/workflows/update-podmanio.yml
+    needs: [check, release]
+    if: needs.check.outputs.buildonly == 'false'
+    secrets: inherit
+    with:
+      version: ${{ needs.check.outputs.version }}

.github/workflows/update-podmanio.yml

@@ -6,7 +6,16 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Release version to build and upload (e.g. "v9.8.7")'
+        description: 'Release version to bump on podman.io'
+        required: true
+  workflow_call:
+    inputs:
+      version:
+        description: 'Release version to bump on podman.io'
+        type: string
+        required: true
+    secrets:
+      PODMANBOT_TOKEN:
         required: true
 
 jobs:

.packit.yaml

@@ -5,6 +5,27 @@
 downstream_package_name: podman
 upstream_tag_template: v{version}
 
+# These files get synced from upstream to downstream (Fedora / CentOS Stream) on every
+# propose-downstream job. This is done so tests maintained upstream can be run
+# downstream in Zuul CI and Bodhi.
+# Ref: https://packit.dev/docs/configuration#files_to_sync
+files_to_sync:
+  - src: rpm/gating.yaml
+    dest: gating.yaml
+    delete: true
+  - src: plans/
+    dest: plans/
+    delete: true
+    mkpath: true
+  - src: test/tmt/
+    dest: test/tmt/
+    delete: true
+    mkpath: true
+  - src: .fmf/
+    dest: .fmf/
+    delete: true
+  - .packit.yaml
+
 packages:
   podman-fedora:
     pkg_tool: fedpkg
@@ -15,6 +36,9 @@ packages:
   podman-eln:
     specfile_path: rpm/podman.spec
 
+# Disable automatic merging for Copr builds (and subsequent Testing Farm)
+merge_pr_in_ci: false
+
 srpm_build_deps:
   - git-archive-all
   - make
@@ -32,10 +56,11 @@ jobs:
         message: "[NON-BLOCKING] Packit jobs failed. @containers/packit-build please check. Everyone else, feel free to ignore."
     enable_net: true
     targets:
-      - fedora-latest-stable-x86_64
-      - fedora-latest-stable-aarch64
-      - fedora-development-x86_64
-      - fedora-development-aarch64
+      - fedora-all-x86_64
+      - fedora-all-aarch64
+    # Re-enable these scans if OpenScanHub starts scanning go packages
+    # https://packit.dev/posts/openscanhub-prototype
+    osh_diff_scan_after_copr_build: false
 
   # Ignore until golang is updated in distro buildroot to go 1.23.3+
   - job: copr_build
@@ -75,6 +100,20 @@ jobs:
     project: podman-next
     enable_net: true
 
+  # Tests on Fedora
+  - job: tests
+    trigger: pull_request
+    packages: [podman-fedora]
+    notifications: *packit_generic_failure_notification
+    targets:
+      - fedora-all
+    tmt_plan: "/plans/system/*"
+    tf_extra_params:
+      environments:
+        - artifacts:
+          - type: repository-file
+            id: https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-$releasever/rhcontainerbot-podman-next-fedora-$releasever.repo
+
   - job: tests
     identifier: cockpit-revdeps
     trigger: pull_request
@@ -103,13 +142,6 @@ jobs:
     dist_git_branches: &fedora_targets
       - fedora-all
 
-  - job: propose_downstream
-    trigger: release
-    update_release: false
-    packages: [podman-centos]
-    dist_git_branches:
-      - c10s
-
   - job: koji_build
     trigger: commit
     packages: [podman-fedora]

.pre-commit-config.yaml

@@ -21,6 +21,7 @@ repos:
       - id: check-executables-have-shebangs
       - id: check-merge-conflict
       - id: check-yaml
+        exclude: rpm/gating.yaml
   - repo: https://github.com/codespell-project/codespell
     # Configuration for codespell is in .codespellrc
     rev: v2.4.1

CONTRIBUTING.md

@@ -117,6 +117,10 @@ Pull requests that change the vendor/ directory directly will not be accepted.
 Instead, changes should be submitted to the original package (defined by the path in `vendor/`; for example, `vendor/github.com/containers/storage` is the [containers/storage library](https://github.com/containers/storage/).
 Once the changes have been merged into the original package, Podman's vendor directory can be updated by using `go get` on the appropriate version of the package, then running `make vendor` or `make vendor-in-container`.
 
+## Codebase structure
+
+Description about important directories in our repository is found [here](./docs/CODE_STRUCTURE.md).
+
 ## Testing
 
 Podman provides an extensive suite of regression tests in the `test/` directory.
@@ -236,7 +240,7 @@ It’s important to describe the change in plain English for the reviewer to ver
 Solve only one problem per patch.
 If your description starts to get long, that’s a sign that you probably need to split up your patch.
 
-If the patch fixes a logged bug entry, refer to that bug entry by number and URL.
+If the patch fixes a logged bug entry, refer to that bug entry by number or URL.
 If the patch follows from a mailing list discussion, give a URL to the mailing list archive.
 Please format these lines as `Fixes:` followed by the URL or, for Github bugs, the bug number preceded by a #.
 For example:

GOVERNANCE.md

@@ -174,7 +174,7 @@ Emeritus Maintainers have no responsibilities or requirements beyond those of an
 
 # Maintainers File
 
-The definitive source of truth for maintainers of a repository is the MAINTAINERS.md file in that repository. The [MAINTAINERS.md](./MAINTAINERS.md) file in the main Podman repository is used for project-spanning roles, including Core Maintainer and Community Manager. Some repositories in the project will also have an OWNERS file, used by the CI system to map users to roles. Any changes to the [OWNERS](./OWNERS) file must make a corresponding change to the [MAINTAINERS.md](./MAINTAINERS.md) file to ensure that file maintains up to date. Most changes to MAINTAINERS.md will require a change to the repository’s OWNERS file (e.g. adding a Reviewer) but some will not (e.g. promoting a Maintainer to a Core Maintainer, which comes with no additional CI-related privileges).
+The definitive source of truth for maintainers of this repository is the local [MAINTAINERS.md](./MAINTAINERS.md) file. The [MAINTAINERS.md](./MAINTAINERS.md) file in the main Podman repository is used for project-spanning roles, including Core Maintainer and Community Manager. Some repositories in the project will also have a local [OWNERS](./OWNERS) file, which the CI system uses to map users to roles. Any changes to the [OWNERS](./OWNERS) file must make a corresponding change to the [MAINTAINERS.md](./MAINTAINERS.md) file to ensure that file remains up to date. Most changes to [MAINTAINERS.md](./MAINTAINERS.md) will require a change to the repository’s [OWNERS](./OWNERS) file (e.g., adding a Reviewer), but some will not (e.g., promoting a Maintainer to a Core Maintainer, which comes with no additional CI-related privileges).
 
 ---
 

MAINTAINERS.md

@@ -3,6 +3,9 @@
 [GOVERNANCE.md](https://github.com/containers/podman/blob/main/GOVERNANCE.md)
 describes the Podman project's governance and the Project Roles used below.
 
+Please note that this file only includes Podman's Maintainers and Reviewers.
+Maintainers and Reviewers for the Skopeo and Buildah projects are found in their respective repository's MAINTAINERS.md files.
+
 ## Maintainers
 
 | Maintainer        | GitHub ID                                                | Project Roles                    | Affiliation                                  |
@@ -13,7 +16,8 @@ describes the Podman project's governance and the Project Roles used below.
 | Paul Holzinger    | [Luap99](https://github.com/Luap99)                      | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
 | Giuseppe Scrivano | [giuseppe](https://github.com/giuseppe)                  | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
 | Miloslav Trmač    | [mtrmac](https://github.com/mtrmac)                      | Core Maintainer                  | [Red Hat](https://github.com/RedHatOfficial) |
-| Neil Smith        | [Neil-Smith](https://github.com/Neil-Smith)              | Community Manager                | [Red Hat](https://github.com/RedHatOfficial) |
+| Mohan Boddu       | [mohanboddu](https://github.com/mohanboddu)              | Community Manager                | [Red Hat](https://github.com/RedHatOfficial) |
+| Neil Smith        | [actionmancan](https://github.com/actionmancan)          | Community Manager                | [Red Hat](https://github.com/RedHatOfficial) |
 | Tom Sweeney       | [TomSweeneyRedHat](https://github.com/TomSweeneyRedHat/) | Maintainer and Community Manager | [Red Hat](https://github.com/RedHatOfficial) |
 | Ygal Blum         | [ygalblum](https://github.com/ygalblum)                  | Maintainer                       | [Red Hat](https://github.com/RedHatOfficial) |
 | Ashley Cui        | [ashley-cui](https://github.com/ashley-cui)              | Maintainer                       | [Red Hat](https://github.com/RedHatOfficial) |
@@ -22,10 +26,14 @@ describes the Podman project's governance and the Project Roles used below.
 | Jake Correnti     | [jakecorrenti](https://github.com/jakecorrenti)          | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Jason Greene      | [n1hility](https://github.com/n1hility)                  | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Jhon Honce        | [jwhonce](https://github.com/jwhonce)                    | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
+| Jan Kaluza        | [jankaluza](https://github.com/jankaluza)                | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
+| Craig Loewen      | [craigloewen-msft](https://github.com/craigloewen-msft)  | Reviewer                         | [Microsoft](https://github.com/microsoft)    |
 | Urvashi Mohnani   | [umohnani8](https://github.com/umohnani8)                | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Aditya Rajan      | [flouthoc](https://github.com/flouthoc)                  | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Jan Rodák         | [Honny1](https://github.com/Honny1)                      | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Valentin Rothberg | [vrothberg](https://github.com/vrothberg)                | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
+| Lewis Roy         | [ninja-quokka](https://github.com/ninja-quokka)          | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
+| Nicola Sella      | [inknos](https://github.com/inknos)                      | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 | Dan Walsh         | [rhatdan](https://github.com/rhatdan)                    | Reviewer                         | [Red Hat](https://github.com/RedHatOfficial) |
 
 ## Alumni

Makefile

@@ -25,6 +25,15 @@ SHELL := $(shell command -v bash;)
 GO ?= go
 GO_LDFLAGS:= $(shell if $(GO) version|grep -q gccgo ; then echo "-gccgoflags"; else echo "-ldflags"; fi)
 GOCMD = CGO_ENABLED=$(CGO_ENABLED) GOOS=$(GOOS) GOARCH=$(GOARCH) $(GO)
+# Podman does not work w/o CGO_ENABLED, except in some very specific cases.
+# Windows and Mac (both podman-remote client only) require CGO_ENABLED=0.
+CGO_ENABLED ?= 1
+# Default to the native OS type and architecture unless otherwise specified
+NATIVE_GOOS := $(shell env -u GOOS $(GO) env GOOS)
+GOOS ?= $(call err_if_empty,NATIVE_GOOS)
+# Default to the native architecture type
+NATIVE_GOARCH := $(shell env -u GOARCH $(GO) env GOARCH)
+GOARCH ?= $(NATIVE_GOARCH)
 COVERAGE_PATH ?= .coverage
 DESTDIR ?=
 EPOCH_TEST_COMMIT ?= $(shell git merge-base $${DEST_BRANCH:-main} HEAD)
@@ -43,16 +52,16 @@ ETCDIR ?= /etc
 LIBDIR ?= ${PREFIX}/lib
 TMPFILESDIR ?= ${LIBDIR}/tmpfiles.d
 USERTMPFILESDIR ?= ${PREFIX}/share/user-tmpfiles.d
-MODULESLOADDIR ?= ${LIBDIR}/modules-load.d
 SYSTEMDDIR ?= ${LIBDIR}/systemd/system
 USERSYSTEMDDIR ?= ${LIBDIR}/systemd/user
 SYSTEMDGENERATORSDIR ?= ${LIBDIR}/systemd/system-generators
 USERSYSTEMDGENERATORSDIR ?= ${LIBDIR}/systemd/user-generators
-REMOTETAGS ?= remote exclude_graphdriver_btrfs btrfs_noversion containers_image_openpgp
+REMOTETAGS ?= remote exclude_graphdriver_btrfs containers_image_openpgp
 BUILDTAGS ?= \
+	grpcnotrace \
 	$(shell hack/apparmor_tag.sh) \
 	$(shell hack/btrfs_installed_tag.sh) \
-	$(shell hack/btrfs_tag.sh) \
+	$(shell hack/sqlite_tag.sh) \
 	$(shell hack/systemd_tag.sh) \
 	$(shell hack/libsubid_tag.sh) \
 	$(if $(filter linux,$(GOOS)), seccomp,)
@@ -61,7 +70,7 @@ BUILDTAGS += ${EXTRA_BUILDTAGS}
 # N/B: This value is managed by Renovate, manual changes are
 # possible, as long as they don't disturb the formatting
 # (i.e. DO NOT ADD A 'v' prefix!)
-GOLANGCI_LINT_VERSION := 2.1.2
+GOLANGCI_LINT_VERSION := 2.2.2
 PYTHON ?= $(shell command -v python3 python|head -n1)
 PKG_MANAGER ?= $(shell command -v dnf yum|head -n1)
 # ~/.local/bin is not in PATH on all systems
@@ -83,7 +92,7 @@ endif
 # and except anything in a dot subdirectory. If any of these files is
 # newer than our target (bin/podman{,-remote}), a rebuild is
 # triggered.
-SOURCES = $(shell find . -path './.*' -prune -o \( \( -name '*.go' -o -name '*.c' \) -a ! -name '*_test.go' \) -print)
+SOURCES = $(shell find . -path './.*' -prune -o \( \( -name '*.go' -o -name '*.c' \) -a ! -name '*_test.go' \) -print) Makefile
 
 BUILDTAGS_CROSS ?= containers_image_openpgp exclude_graphdriver_btrfs exclude_graphdriver_overlay
 CONTAINER_RUNTIME := $(shell command -v podman 2> /dev/null || echo docker)
@@ -179,15 +188,6 @@ CROSS_BUILD_TARGETS := \
 # Dereference variable $(1), return value if non-empty, otherwise raise an error.
 err_if_empty = $(if $(strip $($(1))),$(strip $($(1))),$(error Required variable $(1) value is undefined, whitespace, or empty))
 
-# Podman does not work w/o CGO_ENABLED, except in some very specific cases.
-# Windows and Mac (both podman-remote client only) require CGO_ENABLED=0.
-CGO_ENABLED ?= 1
-# Default to the native OS type and architecture unless otherwise specified
-NATIVE_GOOS := $(shell env -u GOOS $(GO) env GOOS)
-GOOS ?= $(call err_if_empty,NATIVE_GOOS)
-# Default to the native architecture type
-NATIVE_GOARCH := $(shell env -u GOARCH $(GO) env GOARCH)
-GOARCH ?= $(NATIVE_GOARCH)
 ifeq ($(call err_if_empty,GOOS),windows)
 BINSFX := .exe
 SRCBINDIR := bin/windows
@@ -362,7 +362,7 @@ $(IN_CONTAINER): %-in-container:
 	$(PODMANCMD) run --rm --env HOME=/root \
 		-v $(CURDIR):/src -w /src \
 		--security-opt label=disable \
-		docker.io/library/golang:1.22 \
+		quay.io/libpod/validatepr:latest \
 		make $(*)
 
 
@@ -479,21 +479,7 @@ podman-testing: bin/podman-testing
 
 .PHONY: generate-bindings
 generate-bindings: .install.golangci-lint
-ifneq ($(GOOS),darwin)
 	$(GOCMD) generate ./pkg/bindings/... ;
-endif
-
-# DO NOT USE: use local-cross instead
-bin/podman.cross.%:
-	TARGET="$*"; \
-	GOOS="$${TARGET%%.*}"; \
-	GOARCH="$${TARGET##*.}"; \
-	CGO_ENABLED=0 \
-		$(GO) build \
-		$(BUILDFLAGS) \
-		$(GO_LDFLAGS) '$(LDFLAGS_PODMAN)' \
-		-tags '$(BUILDTAGS_CROSS)' \
-		-o "$@" ./cmd/podman
 
 .PHONY: local-cross
 local-cross: $(CROSS_BUILD_TARGETS) ## Cross compile podman binary for multiple architectures
@@ -771,7 +757,7 @@ system.test-binary: .install.ginkgo
 	$(GO) test -c ./test/system
 
 .PHONY: test-binaries
-test-binaries: test/checkseccomp/checkseccomp test/goecho/goecho install.catatonit test/version/version
+test-binaries: test/checkseccomp/checkseccomp test/goecho/goecho test/version/version
 	@echo "Canonical source version: $(call err_if_empty,RELEASE_VERSION)"
 
 .PHONY: tests-included
@@ -848,13 +834,12 @@ podman-remote-release-%.zip: test/version/version ## Build podman-remote for %=$
 		$(MAKE) $(GOPLAT) podman-remote; \
 	fi
 	if [[ "$(GOOS)" == "windows" ]]; then \
-		$(MAKE) $(GOPLAT) TMPDIR="" win-gvproxy; \
+		$(MAKE) $(GOPLAT) TMPDIR="" win-gvproxy-$(GOARCH); \
 	fi
 	if [[ "$(GOOS)" == "darwin" ]]; then \
 		$(MAKE) $(GOPLAT) podman-mac-helper;\
 	fi
 	cp -r ./docs/build/remote/$(GOOS) "$(tmpsubdir)/$(releasedir)/docs/"
-	cp ./contrib/remote/containers.conf "$(tmpsubdir)/$(releasedir)/"
 	$(MAKE) $(GOPLAT) $(_dstargs) SELINUXOPT="" install.remote
 	cd "$(tmpsubdir)" && \
 		zip --recurse-paths "$(CURDIR)/$@" "./$(releasedir)"
@@ -863,10 +848,15 @@ podman-remote-release-%.zip: test/version/version ## Build podman-remote for %=$
 
 # Downloads pre-built gvproxy and win-sshproxy helpers. See comment on GVPROXY_VERSION declaration
 .PHONY: win-gvproxy
-win-gvproxy: test/version/version
+win-gvproxy: win-gvproxy-amd64 # Keep this target for backwards compatibility
+
+win-gvproxy-%: test/version/version
+	$(eval GOARCH := $*)
+	$(eval GVPROXY_FILENAME := $(if $(filter arm64,$(GOARCH)), gvproxy-windows-arm64.exe,gvproxy-windowsgui.exe))
+	$(eval SSHPROXY_FILENAME :=  $(if $(filter arm64,$(GOARCH)), win-sshproxy-arm64.exe, win-sshproxy.exe))
 	mkdir -p bin/windows/
-	curl -sSL -o bin/windows/gvproxy.exe --retry 5 https://github.com/containers/gvisor-tap-vsock/releases/download/$(GVPROXY_VERSION)/gvproxy-windowsgui.exe
-	curl -sSL -o bin/windows/win-sshproxy.exe --retry 5 https://github.com/containers/gvisor-tap-vsock/releases/download/$(GVPROXY_VERSION)/win-sshproxy.exe
+	curl -sSL -o bin/windows/gvproxy.exe --retry 5 https://github.com/containers/gvisor-tap-vsock/releases/download/$(GVPROXY_VERSION)/$(GVPROXY_FILENAME)
+	curl -sSL -o bin/windows/win-sshproxy.exe --retry 5 https://github.com/containers/gvisor-tap-vsock/releases/download/$(GVPROXY_VERSION)/$(SSHPROXY_FILENAME)
 
 .PHONY: rpm
 rpm:  ## Build rpm packages
@@ -888,10 +878,6 @@ rpm-install: package  ## Install rpm packages
 .PHONY: install
 install: install.bin install.remote install.man install.systemd  ## Install binaries to system locations
 
-.PHONY: install.catatonit
-install.catatonit:
-	./hack/install_catatonit.sh
-
 .PHONY: install.remote
 install.remote:
 	install ${SELINUXOPT} -d -m 755 $(DESTDIR)$(BINDIR)
@@ -931,11 +917,6 @@ install.testing:
 	install ${SELINUXOPT} -d -m 755 $(DESTDIR)$(BINDIR)
 	install ${SELINUXOPT} -m 755 bin/podman-testing $(DESTDIR)$(BINDIR)/podman-testing
 
-.PHONY: install.modules-load
-install.modules-load: # This should only be used by distros which might use iptables-legacy, this is not needed on RHEL
-	install ${SELINUXOPT} -m 755 -d $(DESTDIR)${MODULESLOADDIR}
-	install ${SELINUXOPT} -m 644 contrib/modules-load.d/podman-iptables.conf $(DESTDIR)${MODULESLOADDIR}/podman-iptables.conf
-
 .PHONY: install.man
 install.man:
 	install ${SELINUXOPT} -d -m 755 $(DESTDIR)$(MANDIR)/man1
@@ -1060,6 +1041,8 @@ release-artifacts: clean-binaries
 	mv podman-remote-release-darwin_arm64.zip release/
 	$(MAKE) podman-remote-release-windows_amd64.zip
 	mv podman-remote-release-windows_amd64.zip release/
+	$(MAKE) podman-remote-release-windows_arm64.zip
+	mv podman-remote-release-windows_arm64.zip release/
 	$(MAKE) podman-remote-static-linux_amd64
 	tar -cvzf podman-remote-static-linux_amd64.tar.gz bin/podman-remote-static-linux_amd64
 	$(MAKE) podman-remote-static-linux_arm64
@@ -1078,11 +1061,7 @@ uninstall:
 	rm -f $(DESTDIR)$(BINDIR)/podman
 	rm -f $(DESTDIR)$(BINDIR)/podman-remote
 	# Remove related config files
-	rm -f $(DESTDIR)${ETCDIR}/cni/net.d/87-podman-bridge.conflist
 	rm -f $(DESTDIR)${TMPFILESDIR}/podman.conf
-	rm -f $(DESTDIR)${SYSTEMDDIR}/io.podman.socket
-	rm -f $(DESTDIR)${USERSYSTEMDDIR}/io.podman.socket
-	rm -f $(DESTDIR)${SYSTEMDDIR}/io.podman.service
 	rm -f $(DESTDIR)${SYSTEMDDIR}/podman.service
 	rm -f $(DESTDIR)${SYSTEMDDIR}/podman.socket
 	rm -f $(DESTDIR)${USERSYSTEMDDIR}/podman.socket
@@ -1096,7 +1075,6 @@ clean-binaries: ## Remove platform/architecture specific binary files
 .PHONY: clean
 clean: clean-binaries ## Clean all make artifacts
 	rm -rf \
-		_output \
 		$(wildcard podman-*.msi) \
 		$(wildcard podman-remote*.zip) \
 		$(wildcard podman_tmp_*) \
@@ -1106,11 +1084,6 @@ clean: clean-binaries ## Clean all make artifacts
 		test/goecho/goecho \
 		test/version/version \
 		test/__init__.py \
-		test/testdata/redis-image \
-		libpod/container_ffjson.go \
-		libpod/pod_ffjson.go \
-		libpod/container_easyjson.go \
-		libpod/pod_easyjson.go \
 		docs/build \
 		.venv
 	make -C docs clean

OWNERS

@@ -16,8 +16,10 @@ reviewers:
   - baude
   - flouthoc
   - giuseppe
-  - honny1
+  - Honny1
+  - inknos
   - jakecorrenti
+  - jankaluza
   - jwhonce
   - l0rd
   - lsm5
@@ -25,6 +27,7 @@ reviewers:
   - mtrmac
   - n1hility
   - nalind
+  - ninja-quokka
   - rhatdan
   - umohnani8
   - vrothberg

README.md

@@ -4,6 +4,7 @@
 ![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)
 ![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/containers/podman)
 [![Go Report Card](https://goreportcard.com/badge/github.com/containers/libpod)](https://goreportcard.com/report/github.com/containers/libpod)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/10499/badge)](https://www.bestpractices.dev/projects/10499)
 
 <br/>
 

RELEASE_NOTES.md

@@ -1,5 +1,193 @@
 # Release Notes
 
+## 5.5.0
+### Features
+- A new command has been added, `podman machine cp`, to copy files into a running `podman machine` VM.
+- A new command has been added, `podman artifact extract`, to copy some or all of the contents of an OCI artifact to a location on disk.
+- The `--mount` option to `podman create`, `podman run`, and `podman pod create` now supports a new mount type, `--mount type=artifact`, to mount OCI artifacts into containers.
+- The `podman artifact add` command now features two new options, `--append` (to add new files to an existing artifact) and `--file-type` (to specify the MIME type of the file added to the artifact) ([#25884](https://github.com/containers/podman/issues/25884)).
+- The `podman artifact rm` command now features a new option, `--all`, to remove all artifacts in the local store.
+- The `--filter` option to `podman pause`, `podman ps`, `podman restart`, `podman rm`, `podman start`, `podman stop`, and `podman unpause` now accepts a new filter, `command`, which filters on the first element (`argv[0]`) of the command run in the container.
+- The `podman exec` command now supports a new option, `--cidfile`, to specify the ID of the container to exec into via a file ([#21256](https://github.com/containers/podman/issues/21256)).
+- The `podman kube generate` and `podman kube play` commands now supports a new annotation, `io.podman.annotation.pids-limit/$containername`, preserving the PID limit for containers across `kube generate` and `kube play` ([#24418](https://github.com/containers/podman/issues/24418)).
+- Quadlet `.container` units now support three new keys, `Memory=` (set maximum memory for the created container), `ReloadCmd` (execute a command via systemd `ExecReload`), and `ReloadSignal` (kill the container with the given signal via systemd `ExecReload`) ([#22036](https://github.com/containers/podman/issues/22036)).
+- Quadlet `.container`, `.image`, and `.build` units now support two new keys, `Retry` (number of times to retry pulling image on failure) and `RetryDelay` (delay between retries) ([#25109](https://github.com/containers/podman/issues/25109)).
+- Quadlet `.pod` units now support a new key, `HostName=`, to set the pod's hostname ([#25639](https://github.com/containers/podman/issues/25639)).
+- Quadlet files now support a new option, `UpheldBy`, in the `Install` section, corresponding to the systemd `Upholds` option.
+- The names of Quadlet units specified as systemd dependencies are now automatically translated - e.g. `Wants=my.container` is now valid.
+- Podman now generates events for the creation and removal of secrets ([#24030](https://github.com/containers/podman/issues/24030)).
+- A new global option has been added to Podman, `--cdi-spec-dir`, to specify additional search paths for CDI specs to the CDI loader ([#18292](https://github.com/containers/podman/issues/18292) and [#25691](https://github.com/containers/podman/issues/25691)).
+- The `podman build` command now supports a new option, `--inherit-labels` (defaults to true), which controls whether labels are inherited from the base image or base stages.
+- The `podman update` command now supports two new options, `--env` and `--unsetenv`, to alter the environment variables of existing containers ([#24875](https://github.com/containers/podman/issues/24875)).
+
+### Breaking Changes
+- Due to changes in Docker API types, two small breaking changes have been made in the Go bindings for the REST API. The `containers.Commit()` function now returns a new struct (`types.IDResponse`) with identical contents, and the `containers.ExecCreate` function's `handlers.ExecCreateConfig` parameter now contains a different embedded struct, potentially requiring changes to how it is assigned to.
+
+### Changes
+- Podman now requires at least Go 1.23 to build.
+- Healthchecks have been refactored to avoid writing to the database as much as possible, greatly improving performance on systems with many simultaneous healthchecks running.
+- Healthchecks now have a new status, `stopped`, which is reported if the container the healthcheck was run on stopped before the check could be completed ([#25276](https://github.com/containers/podman/issues/25276)).
+- Containers in pods are now stopped in order based on their dependencies, with the infra container being stopped last, preventing application containers from losing networking before they are stopped due to the infra container stopping prematurely.
+- Due to challenges with handling automatic installation, the Windows installer no longer installs WSLv2 or Hyper-V.
+- Quadlet will now print warnings when skipping lines to help identify malformed Quadlet files ([#25339](https://github.com/containers/podman/issues/25339)).
+- Creating `podman machine` VMs with a host mount over the VM's `/tmp` directory is no longer allowed ([#18230](https://github.com/containers/podman/issues/18230)).
+- The `podman logs` command now allows options to be specified after the container name (e.g. `podman logs $containername --follow`) ([#25653](https://github.com/containers/podman/issues/25653)).
+- Podman, by default, no longer uses a pause image for pod infra and service containers. Instead, a root filesystem containing only the `catatonit` binary will be used ([#23292](https://github.com/containers/podman/issues/23292)).
+- The `podman system reset` command no longer removes the user's `podman.sock` API socket.
+- When using Netavark v1.15 and higher, containers in non-default networks will no longer have the default search domain `dns.podman` added. Queries resolving such names will still work.
+- Stopping a Quadlet `.network` unit will now delete the network (if no containers are actively using it) ([#23678](https://github.com/containers/podman/issues/23678)).
+- For security hardening, the `/proc/interrupts` and `/sys/devices/system/cpu/$CPU/thermal_throttle` paths are now masked by default in containers ([#25634](https://github.com/containers/podman/issues/25634)).
+
+### Bugfixes
+- Fixed a bug where healthchecks would still run while a container was paused ([#24590](https://github.com/containers/podman/issues/24590)).
+- Fixed a bug where the remote Podman client on Windows could not mount named volumes with a single-character name into containers ([#25218](https://github.com/containers/podman/issues/25218)).
+- Fixed a bug where mounting an image could panic when run without `CAP_SYS_ADMIN` ([#25241](https://github.com/containers/podman/issues/25241)).
+- Fixed a bug where Podman would not report errors when setting up healthchecks ([#25034](https://github.com/containers/podman/issues/25034)).
+- Fixed a bug where the `podman exec` command would not add the additional groups of the user the exec session was run as unless the user was explicitly added with the `--user` option ([#25610](https://github.com/containers/podman/issues/25610)).
+- Fixed a bug where errors during the `podman network connect` and `podman network disconnect` commands could create errors in the database which would cause `podman inspect` on the container to fail.
+- Fixed a bug where the `podman kube generate` command did not correctly generate YAML for volume mounts using a subpath.
+- Fixed a bug where the `podman system df` command could show a negative reclaimable size.
+- Fixed a bug where accessing a rootful `podman machine` VM that was not `podman-machine-default` (the default VM) with the `podman machine ssh` command would put the user into the rootless shell ([#25332](https://github.com/containers/podman/issues/25332)).
+- Fixed a bug where the `podman machine init` would report nonsensical memory values in error messages when trying to create a machine with more memory than the system.
+- Fixed a bug where the remote Podman client's `podman start --attach` command would incorrectly print an error when run on a container created with the `--rm` option ([#25965](https://github.com/containers/podman/issues/25965)).
+- Fixed a bug where the remote Podman client's `podman pull` command could hang and leak memory if the server was unexpectedly stopped or encountered an error during a pull.
+- Fixed a bug where the remote Podman client's `podman cp` command would, on Windows, often fail to copy files into the container due to improper handling of Windows paths ([#14862](https://github.com/containers/podman/issues/14862)).
+- Fixed a bug where the `podman container clone` command did not correctly copy healthcheck settings to the new container ([#21630](https://github.com/containers/podman/issues/21630)).
+- Fixed a bug where the `podman kube play` command would fail to start empty pods ([#25786](https://github.com/containers/podman/issues/25786)).
+- Fixed a bug where the `podman volume ls` command did not output headers when no volumes were present ([#25911](https://github.com/containers/podman/issues/25911)).
+- Fixed a bug where healthcheck configuration provided by a container's image could not be overridden unless the `--health-cmd` option was specified when creating the container ([#20212](https://github.com/containers/podman/issues/20212)).
+- Fixed a bug where the `--user` option to `podman create` and `podman run` could not be used with users added to the container by the `--hostuser` option ([#25805](https://github.com/containers/podman/issues/25805)).
+- Fixed a bug where the `podman system reset` command on FreeBSD would incorrectly print an error.
+- Fixed a bug where stopping the `podman machine start` command with SIGINT could result in machine state being incorrectly set to "Starting" ([#24416](https://github.com/containers/podman/issues/24416)).
+- Fixed a bug where the `podman machine start` command would fail when starting a VM with volume mounts containing spaces using the HyperV machine provider ([#25500](https://github.com/containers/podman/issues/25500)).
+
+### API
+- Fixed a bug where the Compat Create API for Containers ignored ulimits specified in the request when Podman was run rootless ([#25881](https://github.com/containers/podman/issues/25881)).
+
+### Misc
+- Erroneous errors from the `ExecStartAndAttach()` function in the Go bindings for the REST API have been silenced, where the function would incorrectly report errors when stdin was consumed after the exec session was stopped ([#25344](https://github.com/containers/podman/issues/25344)).
+- Updated Buildah to v1.40.0
+- Updated the containers/common library to v0.63.0
+- Updated the containers/image library to v5.35.0
+- Updated the containers/storage library to v1.58.0
+
+## 5.4.2
+### Bugfixes
+- Fixed a bug where the `podman import` command could not import images compressed with algorithms other than gzip ([#25593](https://github.com/containers/podman/issues/25593)).
+- Fixed a bug where the `podman cp` command could deadlock when copying into a non-empty volume on a container that is not running ([#25585](https://github.com/containers/podman/issues/25585)).
+
+### API
+- Fixed a bug where the default values for some fields in the Libpod Create endpoint for Containers did not have sensible defaults for some healthcheck fields, causing unrestricted log growth for containers which did not set these fields ([#25473](https://github.com/containers/podman/issues/25473)).
+
+### Misc
+- Updated vendored Buildah to v1.39.4
+- Updated the containers/common library to v0.62.3
+- Updated the containers/image library to v5.34.3
+- Updated the containers/storage library to v1.57.2
+
+## 5.4.1
+### Bugfixes
+- Fixed a bug where volume quotas were not being applied ([#25368](https://github.com/containers/podman/issues/25368)).
+- Fixed a bug where the `--pid-limit=-1` option did not function properly with containers using the `runc` OCI runtime.
+- Fixed a bug where the `podman artifact pull` command did not respect the `--retry-delay` option.
+- Fixed a bug where Podman would leak a file and directory for every container created.
+- Fixed a bug where the `podman wait` command would sometimes error when waiting for a container set to auto-remove.
+- Fixed a bug where Quadlet `.kube` units would not report an error (and stay running) even when a pod failed to start ([#20667](https://github.com/containers/podman/issues/20667)).
+
+### API
+- Fixed a bug where the Compat DF endpoint did not correctly report total size of all images.
+
+### Misc
+- Updated Buildah to v1.39.2
+- Updated the containers/common library to v0.62.1
+- Updated the containers/image library to v5.34.1
+
+## 5.4.0
+### Features
+- A preview of Podman's support for OCI artifacts has been added through the `podman artifact` suite of commands, including `add`, `inspect`, `ls`, `pull`, `push`, and `rm`. This support is very early and not fully complete, and the command line interface for these tools has not been finalized. We welcome feedback on the new artifact experience through our issue tracker!
+- The `podman update` command now supports a wide variety of options related to healthchecks (including `--health-cmd` to define a new healthcheck and `--no-healthcheck` to disable an existing healthcheck), allowing healthchecks to be added to, removed from, and otherwise updated on existing containers. You can find full details on the 15 added options in the manpage.
+- The `--mount type=volume` option for the `podman run`, `podman create`, and `podman volume create` commands now supports a new option, `subpath=`, to make only a subset of the volume visible in the container ([#20661](https://github.com/containers/podman/issues/20661)).
+- The `--userns=keep-id` option for the `podman run`, `podman create`, and `podman pod create` commands now supports a new option, `--userns=keep-id:size=`, to configure the size of the user namespace ([#24387](https://github.com/containers/podman/issues/24837)).
+- The `podman kube play` command now supports Container Device Interface (CDI) devices ([#17833](https://github.com/containers/podman/issues/17833)).
+- The `podman machine init` command now supports a new option, `--playbook`, to run an Ansible playbook in the created VM on first boot for initial configuration.
+- Quadlet `.pod` files now support a new field, `ShmSize`, to specify the size of the pod's shared SHM ([#22915](https://github.com/containers/podman/issues/22915)).
+- The `podman run`, `podman create`, and `podman pod create` commands now support a new option, `--hosts-file`, to define the base file used for `/etc/hosts` in the container.
+- The `podman run`, `podman create`, and `podman pod create` commands now support a new option, `--no-hostname`, which disables the creation of `/etc/hostname` in the container ([#25002](https://github.com/containers/podman/issues/25002)).
+- The `podman network create` command now supports a new option for `bridge` networks, `--opt mode=unmanaged`, which allows Podman to use an existing network bridge on the system without changes.
+- The `--network` option to `podman run`, `podman create`, and `podman pod create` now accepts a new option for `bridge` networks, `host_interface_name`, which specifies a name for the network interface created outside the container.
+- The `podman manifest rm` command now supports a new option, `--ignore`, to not error when removing manifests that do not exist.
+- The `podman system prune` command now supports a new option, `--build`, to remove build containers leftover from prematurely terminated builds.
+- The `podman events` command now generates events for the creation and removal of networks ([#24032](https://github.com/containers/podman/issues/24032)).
+
+### Breaking Changes
+- Due to a lack of availability of hardware to test on, the Podman maintainers are no longer capable of providing full support for Podman on Intel Macs. Binaries and machine images will still be produced, and pull requests related to MacOS on Intel systems will still be merged, but bugs will be fixed on a best effort basis only. We welcome any potential new maintainers who would be able to assist in restoring full support.
+- Quadlet previously incorrectly allowed `:` as a character to define comments. This was a mistake; developer intent and documentation was that `#` and `;` were to be used as comment characters instead, matching systemd. This has been corrected, and semicolons now define comments instead of colons.
+
+### Changes
+- Podman now passes container hostnames to Netavark, which will use them for any DHCP requests for the container.
+- Partial pulls of `zstd:chunked` images now only happen for images that have a `RootFS.DiffID` entry in the image's OCI config JSON, and require the layer contents to match. This resolves issues with image ID ambiguity when partial pulls were enabled.
+- Packagers can now set the `BUILD_ORIGIN` environment variable when building podman from the `Makefile`. This provides information on who built the Podman binary, and is displayed in `podman version` and  `podman info`. This will help upstream bug reports, allowing maintainers to trace how and where the binary was built and installed from.
+
+### Bugfixes
+- Fixed a bug where `podman machine` VMs on WSL could fail to start when using usermode networking could fail to start due to a port conflict ([#20327](https://github.com/containers/podman/issues/20327)).
+- Fixed a bug where overlay mounts could not be made at paths where the image specifies a volume ([#24555](https://github.com/containers/podman/issues/24555)).
+- Fixed a bug where the `podman build` command did not honor the `no_pivot_root` setting from `containers.conf` ([#24546](https://github.com/containers/podman/issues/24546)).
+- Fixed a bug where volumes would have the wrong permissions if `podman cp` was used to copy into a fresh volume in a container that had never been started.
+- Fixed a bug where using `podman cp` to copy into a named volume requiring a mount (image volumes, volumes backed by a volume plugin, or other volumes with options) would fail when the container being copied into was stopped.
+- Fixed a bug where rlimits would be set incorrectly when Podman was run as root but without `CAP_SYS_RESOURCE` ([#24692](https://github.com/containers/podman/issues/24692)).
+- Fixed a bug where the `podman stats --all` command would fail if a container started with `--cgroups=none` was present ([#24632](https://github.com/containers/podman/issues/24632)).
+- Fixed a bug where the `podman info` command would only return details on one image store even if additional image stores were configured in `storage.conf`.
+- Fixed a bug where the `podman update` command could reset resource limits that were not being modified to default ([#24610](https://github.com/containers/podman/issues/24610)).
+- Fixed a bug where the remote Podman client's `podman update` command could not update resource limits on devices mounted into the container ([#24734](https://github.com/containers/podman/issues/24734)).
+- Fixed a bug where the `podman manifest annotate` command could panic when the `--index` option was used ([#24750](https://github.com/containers/podman/issues/24750)).
+- Fixed a bug where a Quadlet container reusing another container's network could cause errors if the second container was not already running.
+- Fixed a bug where Quadlet files containing lines with a trailing backslash could cause an infinite loop during parsing ([#24810](https://github.com/containers/podman/issues/24810)).
+- Fixed a bug where Quadlet would, when run as a non-root user, not generate for files in subfolders of `/etc/containers/systemd/users/` ([#24783](https://github.com/containers/podman/issues/24783)).
+- Fixed a bug where values in Quadlet files containing octal escape sequences were incorrectly unescaped.
+- Fixed a bug where `podman generate kube` could generate persistent volumes with mixed-case names or names containing an underscore, which are not supported by Kubernetes ([#16542](https://github.com/containers/podman/issues/16542)).
+- Fixed a bug where the `ptmxmode` option to `--mount type=devpts` did not function.
+- Fixed a bug where shell completion on Windows would include `.exe` in the executable name, breaking completion on some shells.
+- Fixed a bug where the output of `podman inspect` on containers did not include the ID of the network the container was joined to, improving Docker compatibility ([#24910](https://github.com/containers/podman/issues/24910)).
+- Fixed a bug where containers created with the remote API incorrectly included a create command ([#25026](https://github.com/containers/podman/issues/25026)).
+- Fixed a bug where it was possible to specify the `libkrun` backend for VMs on Intel Macs (`libkrun` only supports Arm systems).
+- Fixed a bug where `libkrun` and `applehv` VMs from `podman machine` could be started at the same time on Macs ([#25112](https://github.com/containers/podman/issues/25112)).
+- Fixed a bug where `podman exec` commands could not detach from the exec session using the detach keys ([#24895](https://github.com/containers/podman/issues/24895)).
+- Fixed a bug where Podman would fail to start due to a database configuration mismatch when certain fields were configured to the empty string ([#24738](https://github.com/containers/podman/issues/24738)).
+
+### API
+- The Compat and Libpod Build APIs for Images now support a new query parameter, `nohosts`, which (when set to true) does not create `/etc/hosts` in the image when building.
+- Fixed a bug where the Compat Create API for Containers did not honor CDI devices, preventing (among other things) the use of GPUs with `docker compose` ([#19338](https://github.com/containers/podman/issues/19338)).
+
+### Misc
+- The Docker alias script has been fixed to better handle variable substitution.
+- Fixed a bug where `podman-restart.service` functioned incorrectly when no containers were present.
+- Updated Buildah to v1.39.0
+- Updated the containers/common library to v0.62.0
+- Updated the containers/storage library to v1.57.1
+- Updated the containers/image library to v5.34.0
+
+## 5.3.2
+### Security
+- This release contains Buildah v1.38.1 which addresses [CVE-2024-11218](https://github.com/advisories/GHSA-5vpc-35f4-r8w6).
+
+### Bugfixes
+- Fixed a bug where Quadlet `.build` files could create an invalid podman command line when `Pull=` was used ([#24599](https://github.com/containers/podman/issues/24599)).
+- Fixed a bug where the Mac installer did not install the Podman manpages ([#24756](https://github.com/containers/podman/issues/24756)).
+
+### Misc
+- Updated Buildah to v1.38.1
+- Updated the containers/common library to v0.61.1
+- Updated the containers/storage library to v1.56.1
+- Updated the containers/image library to v5.33.1
+
+## 5.3.1
+### Bugfixes
+- Fixed a bug where the `--ignition-path` option to `podman machine init` would prevent creation of necessary files for the VM, rendering it unusable ([#23544](https://github.com/containers/podman/issues/23544)).
+- Fixed a bug where rootless containers using the `bridge` networking mode would be unable to start due to a panic caused by a nil pointer dereference ([#24566](https://github.com/containers/podman/issues/24566)).
+- Fixed a bug where Podman containers would try to set increased rlimits when started in a user namespace, rendering containers unable to start ([#24508](https://github.com/containers/podman/issues/24508)).
+- Fixed a bug where certain SSH configurations would make the remote Podman client unable to connect to the server ([#24567](https://github.com/containers/podman/issues/24567)).
+- Fixed a bug where the Windows installer could install WSLv2 when upgrading an existing Podman installation that used the Hyper-V virtualization backend.
+
 ## 5.3.0
 ### Features
 - The `podman kube generate` and `podman kube play` commands can now create and run Kubernetes Job YAML ([#17011](https://github.com/containers/podman/issues/17011)).

RELEASE_PROCESS.md

@@ -12,10 +12,10 @@ development efforts occur on the *main* branch.  Branches with a
 
 ## Release workflow expectations
 
-* You have push access to the [upstream podman repository](https://github.com/containers/podman.git)
+* You have push access to the [upstream podman repository](https://github.com/containers/podman.git), and the upstream [podman-machine-os repository](https://github.com/containers/podman-machine-os)
 * You understand all basic `git` operations and concepts, like creating commits,
   local vs. remote branches, rebasing, and conflict resolution.
-* You have access to your public and private *GPG* keys.
+* You have access to your public and private *GPG* keys. They should also be documented on our [release keys repo](https://github.com/containers/release-keys).
 * You have reliable internet access (i.e. not the public WiFi link at McDonalds)
 * Other podman maintainers are online/available for assistance if needed.
 * For a **major** release, you have 4-8 hours of time available, most of which will
@@ -25,12 +25,11 @@ development efforts occur on the *main* branch.  Branches with a
 * You will announce the release on the proper platforms
   (i.e. Podman blog, Twitter, Mastodon Podman and Podman-Desktop mailing lists)
 
-# Prechecks
+# Release cadence
 
-Two days before actually cutting a release (including RCs), send an announcement to the
-[podman-desktop](mailto:podman-desktop@lists.podman.io)
-mailing list about the upcoming release. This will help the Podman Desktop team test and schedule
-their own new release.
+Upstream major or minor releases occur the 2nd week of February, May, August, November.
+Branching and RC's may start several weeks beforehand.
+Patch releases occur as-needed.
 
 # Releases
 
@@ -66,9 +65,8 @@ spelled with complete minutiae.
 
 1. Create a new upstream release branch (if none already exist).
 
-   1. Check if a release branch is needed. Typically, major and minor version bumps
-      should be branched sometime during the release candidate phase. Patch
-      releases typically already have a branch created.
+   1. Check if a release branch is needed. All major and minor releases should be branched before RC1.
+      Patch releases typically already have a branch created.
       Branching ensures all changes are curated before inclusion in the
       release, and no new features land after the *release-candidate* phases
       are complete.
@@ -78,13 +76,11 @@ spelled with complete minutiae.
       `git checkout -b vX.Y`.  Where `X.Y` represent the complete release
       version-name, including any suffix (if any) like `-rhel`.  ***DO NOT***
       include any `-rc` suffix in the branch name.
-   1. Edit the `.cirrus.yml` file, changing the `DEST_BRANCH` value (under the
-      `env` section) to the new, complete branch name (e.x. `vX.Y`).
-       Commit and sign, using the description
-      `Cirrus: Update operating branch`.
    1. Push the new branch otherwise unmodified (`git push upstream vX.Y`).
-   1. Automation will begin executing on the branch immediately.  Because
-      the repository allows out-of-sequence PR merging, it is possible that
+   1. Check if a release branch is needed on the `podman-machine-os` repo.
+      If so, repeat above steps for `podman-machine-os`.
+   1. Back on the podman repo, automation will begin executing on the branch immediately.
+      Because the repository allows out-of-sequence PR merging, it is possible that
       merge order introduced bugs/defects.  To establish a clean
       baseline, observe the initial CI run on the branch for any unexpected
       failures.  This can be done by going directly to
@@ -153,12 +149,7 @@ spelled with complete minutiae.
    1. Commit the `RELEASE_NOTES.md` changes, using the description
       `Create release notes for vX.Y.Z` (where `X`, `Y`, and `Z` are the
       actual version numbers).
-   1. Open a Release Notes PR, or include this commit with the version bump PR
-       * If you decide to open a PR with just release notes, make sure that
-         the commit has the prefix `[CI:DOCS]` to avoid triggering
-         lengthy automated testing.
-       * Otherwise, the release notes commit can also be included in the
-         following release PR.
+   1. Open a Release Notes PR, or include this commit with the version bump PR.
 
 1. Update version numbers and push tag
 
@@ -177,29 +168,53 @@ spelled with complete minutiae.
       task `Optional Release Test`.  In the right-hand window pane, click
       the `trigger` button and wait for the test to go green.  *This is a
       critical step* which confirms the commit is worthy of becoming a release.
+   1. In the PR, under the *Checks* tab, a GitHub actions [task](https://github.com/containers/podman/actions/workflows/machine-os-pr.yml) will run.
+      This action opens a PR on the [podman-machine-os repo](https://github.com/containers/podman-machine-os), which builds VM images for the release. The action will also link the `podman-machine-os` pr in a comment on the podman PR
+      This action also automatically applies the `do-not-merge/wait-machine-image-build` to the Podman PR, which blocks merging until VM images are built and published.
+   1. Go to the `podman-machine-os` bump pr, by clicking the link in the comment, or by finding it in the [podman-machine-os repo](https://github.com/containers/podman-machine-os/pulls).
+      1. Wait for automation to finish running
+      1. Once you are sure that there will be no more force pushes on the Podman release PR, merge the `podman-machine-os` bump PR
+      1. Tag the `podman-machine-os` bump commit with the same version as the podman release. (git tag -s -m 'vX.Y.Z' vX.Y.Z)
+      1. Push the tag.
+      1. The tag will automatically trigger a Cirrus task, named “Publish Image”,
+         to publish the release images. It will push the images to Quay and cut a release on the `podman-machine-os` repo. Wait for this task to complete. You can monitor the task on the [Cirrus CI dashboard](https://cirrus-ci.com/github/containers/podman-machine-os)
+   1. Return to the Podman repo
+   1. The `do-not-merge/wait-podman-machine-os` label should be automatically
+      un-set once the `podman-machine-os` release is finished.
+   1. Wait for all other PR checks to pass.
+   1. Wait for other maintainers to merge the PR.
    1. Tag the `Bump to vX.Y.Z` commit as a release by running
-      `git tag -s -m 'vX.Y.Z' vX.Y.Z $HASH` where `$HASH` is specified explicitly
-      and carefully, to avoid (basically) unfixable accidents (if they are pushed).
-   1. Change `version/rawversion/version.go` again. This time, bump the **patch** version and
-      re-add the `-dev` suffix to indicate this is a non-released version of Podman.
-   1. Change `contrib/spec/podman.spec.in`, bumping **patch** number of `Version`.
-   1. Commit these changes with the message `Bump to X.Y.Z-dev`.
-   1. Push your local branch to your GitHub fork (and the PR) again.
-   1. The PR should now have two commits that look very similar to
-      https://github.com/containers/podman/pull/7787
-      Note: Backports and release note commits may also be included in the release PR.
-   1. Wait for at least all the "Build" and "Verify" (or similar) CI Testing
-      steps to complete successfully.  No need to wait for complete integration
-      4and system-testing (it was already done on substantially the same code, above).
-   1. Merge the PR (or ask someone else to review and merge, to be safer).
+      `git tag -s -m 'vX.Y.Z' vX.Y.Z $HASH` where `$HASH` is specified explicitly and carefully, to avoid (basically) unfixable accidents
+      (if they are pushed).
    1. **Note:** This is the last point where any test-failures can be addressed
       by code changes. After pushing the new version-tag upstream, no further
       changes can be made to the code without lots of unpleasant efforts.  Please
       seek assistance if needed, before proceeding.
-
    1. Assuming the "Bump to ..." PR merged successfully, and you're **really**
       confident the correct commit has been tagged, push it with
       `git push upstream vX.Y.Z`
+1. Monitor release automation
+   1. After the tag is pushed, the release GitHub action should run.
+      This action creates the GitHub release from the pushed tag,
+      and automatically builds and uploads the binaries and installers to the release.
+      1. The following artifacts should be attached to the release:
+         * podman-installer-macos-amd64.pkg
+         * podman-installer-macos-arm64.pkg
+         * podman-installer-macos-universal.pkg
+         * podman-installer-windows-amd64.exe
+         * podman-installer-windows-arm64.exe
+         * podman-remote-release-darwin_amd64.zip
+         * podman-remote-release-darwin_arm64.zip
+         * podman-remote-release-windows_amd64.zip
+         * podman-remote-release-windows_arm64.zip
+         * podman-remote-static-linux_amd64.tar.gz
+         * podman-remote-static-linux_arm64.tar.gz
+         * shasums
+      1. An email should have been sent to the [podman](mailto:podman@lists.podman.io) mailing list.
+         Keep an eye on it make sure the email went through to the list.
+   1. The release action will also bump the Podman version on podman.io. It will open a PR if a non-rc latest version is released. Go to the [podman.io](https://github.com/containers/podman.io) repo and merge the PR opened by this action, if needed.
+   1. After the tag is pushed, an action to bump to -dev will run. A PR will be opened for this bump. Merge this PR if needed.
+
 
 1. Locate, Verify release testing is proceeding
 
@@ -220,68 +235,6 @@ spelled with complete minutiae.
       "View All Tasks".
    1. Keep this page open to monitor its progress and for use in future steps.
 
-1. Bump main `-dev` version
-
-   1. If you made a release branch and bumped **major** or **minor** version
-      Complete the "Update version numbers and push tag" steps above on the
-      *main* branch.  Bump the **minor** version and set the **patch**
-      version to 0.  For example, after pushing the v2.2.0 release, *main*
-      should be set to v2.3.0-dev.
-   1. Create a "Bump to vX.Y.Z-dev" commit with these changes.
-   1. Update `RELEASE_NOTES.md` on main. Commit these changes.
-   1. Create a PR with the above commits, and oversee it's merging.
-
-1. Create GitHub Release entry and upload assets
-
-   1. Return to the Cirrus-CI Build page for the new release tag, confirm
-      (or wait for) it to complete, re-running any failed tasks as appropriate.
-   1. Go to `https://github.com/containers/podman/releases/tag/vX.Y.Z` and
-      press the "Edit Release" button.  Change the name to the form `vX.Y.Z`
-   1. If this is a release candidate be certain to click the pre-release
-      checkbox at the bottom of the page.
-   1. If this new release will be the latest version released, be certain to
-      click the latest release checkbox at the bottom of the page.
-   1. Copy and paste the release notes for the release into the body of
-      the release.
-   1. Click the Publish button to make the release (or pre-release)
-      available.
-   1. For all releases, including RC's, artifacts should be published. The
-      release-artifacts, upload-win-installer, and mac-pkg GitHub Actions
-      should automatically take care of building, signing, and uploading artifacts.
-      Check the "Actions" tab, after publishing you should see the jobs running.
-      There may be more than one running due to the multiple
-      event states triggered, but this can be ignored, as any duplicates
-      will gracefully back-off. The job takes 5-6 minutes to complete.
-
-      Please note that the Windows action depends on the artifact action, and will be
-      triggered after the artifact action succeeds.
-
-      If any of these actions are somehow not triggered, you can manually trigger them
-
-      ### *CLI Approach*
-      1. Install the [GitHub CLI](https://github.com/cli/cli#installation)
-      1. Run (replacing below version number to release version)
-         ```
-         gh workflow run "ACTION NAME" -F version="vX.Y.Z"
-         ```
-      ### *GUI Approach*
-      1. Go to the "Actions" tab
-      1. On the left pick the required action to be triggered.
-      1. A blue box will appear above the job list with a right side drop
-         -down. Click the drop-down and specify the version number in the
-         dialog that appears
-   1. Check that all following artifacts are now attached to the release
-         * podman-remote-release-darwin_amd64.zip
-         * podman-remote-release-darwin_arm64.zip
-         * podman-remote-release-windows_amd64.zip
-         * podman-vX.Y.Z.msi
-         * podman-remote-static-linux_amd64.tar.gz
-         * podman-remote-static-linux_arm64.tar.gz
-         * podman-installer-macos-amd64.pkg
-         * podman-installer-macos-arm64.pkg
-         * podman-5.2.1-setup.exe
-         * shasums
-
 1. Update Cirrus-CI cron job list
    1. After any Major or significant minor (esp. `-rhel`) releases, it's critical to
       maintain the Cirrus-CI cron job list.  This applies to all containers-org repos,
@@ -310,9 +263,5 @@ spelled with complete minutiae.
          Highlight key features and important changes or fixes. Link to the GitHub release.
          Make sure the blog post is properly tagged with the Announcement, Release, and Podman tags,
          and any other appropriate tags.
-      1. For all releases, including patch releases and RC's, send an email to the [podman](mailto:podman@lists.podman.io) and [podman-desktop](mailto:podman-desktop@lists.podman.io) mailing lists. This should be automated by the release-artifacts
-      action, but it's best to keep and eye on it to see if the email went through to the lists.
-         Link the to release blog and GitHub release.
-      1. Update [LATEST_VERSION](https://github.com/containers/podman.io/blob/main/static/data/global.ts) on the Podman.io website.
       1. Tweet the release. Make a Mastodon post about the release.
       1. RC's can also be announced if needed.

build_windows.md

@@ -11,7 +11,6 @@ Windows.
   - [Git and go](#git-and-go)
   - [Pandoc](#pandoc)
   - [.NET SDK](#net-sdk)
-  - [Visual Studio Build Tools](#visual-studio-build-tools)
   - [Virtualization Provider](#virtualization-provider)
     - [WSL](#wsl)
     - [Hyper-V](#hyper-v)
@@ -59,17 +58,19 @@ reloaded. This can also be manually changed by configuring the `PATH`:
 $env:Path += ";C:\Program Files\Go\bin\;C:\Program Files\Git\cmd\"
 ```
 
-### Pandoc
+### Pandoc (optional)
 
 [Pandoc](https://pandoc.org/) is used to generate Podman documentation. It is
-required for building the documentation and the
-[bundle installer](#build-the-installer). It can be avoided when building and
-testing the
-[Podman client for Windows](#build-and-test-the-podman-client-for-windows) or
-[the standalone `podman.msi` installer](#build-and-test-the-standalone-podmanmsi-file).
+used for building the documentation.
 Pandoc can be installed from https://pandoc.org/installing.html. When performing
 the Pandoc installation one, has to choose the option "Install for all users"
 (to put the binaries into "Program Files" directory).
+Alternatively, Podman documentation can be built using a container with the target
+`docs-using-podman` in the `winmake.ps1` script.
+
+```pwsh
+.\winmake docs-using-podman
+```
 
 ### .NET SDK
 
@@ -88,30 +89,6 @@ used too and can be installed using `dotnet install`:
 dotnet tool install --global wix
 ```
 
-### Visual Studio Build Tools
-
-The installer includes a C program that checks the installation of the
-pre-required virtualization providers (WSL or Hyper-V). Building this program
-requires the
-[Microsoft C/C++ compiler](https://learn.microsoft.com/en-us/cpp/build/building-on-the-command-line?view=msvc-170) and the
-[PowerShell Module VSSetup](https://github.com/microsoft/vssetup.powershell):
-
-1. Download the Build Tools for Visual Studio 2022 installer
-```pwsh
-Invoke-WebRequest -Uri 'https://aka.ms/vs/17/release/vs_BuildTools.exe' -OutFile "$env:TEMP\vs_BuildTools.exe"
-```
-2. Run the installer with the parameter to include the optional C/C++ Tools
-```pwsh
-& "$env:TEMP\vs_BuildTools.exe" --passive --wait `
-                      --add Microsoft.VisualStudio.Workload.VCTools `
-                      --includeRecommended `
-                      --remove Microsoft.VisualStudio.Component.VC.CMake.Project
-```
-3. Install the PowerShell Module VSSetup
-```pwsh
-Install-Module VSSetup
-```
-
 ### Virtualization Provider
 
 Running Podman on Windows requires a virtualization provider. The supported
@@ -312,8 +289,7 @@ To learn how to use the Podman client, refer to its
 ## Build and test the Podman Windows installer
 
 The Podman Windows installer (e.g., `podman-5.1.0-dev-setup.exe`) is a bundle
-that includes an msi package (`podman.msi`) and installs the WSL kernel
-(`podman-wslkerninst.exe`). It's built using the
+that includes an msi package (`podman.msi`). It's built using the
 [WiX Toolset](https://wixtoolset.org/) and the
 [PanelSwWixExtension](https://github.com/nirbar/PanelSwWixExtension/tree/master5)
 WiX extension. The source code is in the folder `contrib\win-installer`.
@@ -326,7 +302,7 @@ To build the installation bundle, run the following command:
 .\winmake.ps1 installer
 ```
 
-:information_source: making `podman-remote`, `win-gvproxy`, and `docs` is
+:information_source: making `podman-remote`, `win-gvproxy`, and `docs` (or `docs-using-podman`) is
 required before running this command.
 
 Locate the installer in the `contrib\win-installer` folder (relative to checkout
@@ -334,9 +310,6 @@ root) with a name like `podman-5.2.0-dev-setup.exe`.
 
 The `installer` target of `winmake.ps1` runs the script
 `contrib\win-installer\build.ps1` that, in turns, executes:
-
-- `build-hooks.bat`: builds `podman-wslkerninst.exe` (WSL kernel installer) and
-  `podman-msihooks.dll` (helper that checks if WSL and Hyper-V are installed).
 - `dotnet build podman.wixproj`: builds `podman.msi` from the WiX source files `podman.wxs`,
   `pages.wxs`, `podman-ui.wxs` and `welcome-install-dlg.wxs`.
 - `dotnet build podman-setup.wixproj`: builds `podman-setup.exe` file from
@@ -519,7 +492,13 @@ tools:
   [`.pre-commit-config.yaml`](.pre-commit-config.yaml)
 
 :information_source: Install [golangci-lint](https://golangci-lint.run) and
-[pre-commit](https://pre-commit.com) to run `winmake.ps1 lint`.
+[pre-commit](https://pre-commit.com) to run `winmake.ps1 lint`:
+    ```pwsh
+    winget install -e golangci-lint.golangci-lint
+    winget install -e Python.Python.3.13
+    pip install pre-commit
+    ```
+
 
 ### winmake validatepr
 

cmd/podman-wslkerninst/main.go

@@ -48,7 +48,7 @@ func installWslKernel() error {
 	)
 	backoff := 500 * time.Millisecond
 	for i := 1; i < 6; i++ {
-		err = wutil.SilentExec(wutil.FindWSL(), "--update")
+		err = wutil.SilentExec("--update")
 		if err == nil {
 			break
 		}

cmd/podman/artifact/add.go

@@ -2,6 +2,7 @@ package artifact
 
 import (
 	"fmt"
+	"path/filepath"
 
 	"github.com/containers/common/pkg/completion"
 	"github.com/containers/podman/v5/cmd/podman/common"
@@ -61,6 +62,8 @@ func init() {
 }
 
 func add(cmd *cobra.Command, args []string) error {
+	artifactName := args[0]
+	blobs := args[1:]
 	opts := new(entities.ArtifactAddOptions)
 
 	annots, err := utils.ParseAnnotations(addOpts.Annotations)
@@ -72,7 +75,18 @@ func add(cmd *cobra.Command, args []string) error {
 	opts.Append = addOpts.Append
 	opts.FileType = addOpts.FileType
 
-	report, err := registry.ImageEngine().ArtifactAdd(registry.Context(), args[0], args[1:], opts)
+	artifactBlobs := make([]entities.ArtifactBlob, 0, len(blobs))
+
+	for _, blobPath := range blobs {
+		artifactBlob := entities.ArtifactBlob{
+			BlobFilePath: blobPath,
+			FileName:     filepath.Base(blobPath),
+		}
+
+		artifactBlobs = append(artifactBlobs, artifactBlob)
+	}
+
+	report, err := registry.ImageEngine().ArtifactAdd(registry.Context(), artifactName, artifactBlobs, opts)
 	if err != nil {
 		return err
 	}

cmd/podman/common/build.go

@@ -25,6 +25,7 @@ import (
 	"github.com/containers/podman/v5/cmd/podman/utils"
 	"github.com/containers/podman/v5/pkg/domain/entities"
 	"github.com/containers/podman/v5/pkg/env"
+	"github.com/openshift/imagebuilder"
 	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
 )
@@ -522,7 +523,7 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 		Annotations:             flags.Annotation,
 		Args:                    args,
 		BlobDirectory:           flags.BlobCache,
-		BuildOutput:             flags.BuildOutput,
+		BuildOutputs:            flags.BuildOutputs,
 		CacheFrom:               cacheFrom,
 		CacheTo:                 cacheTo,
 		CacheTTL:                cacheTTL,
@@ -585,9 +586,9 @@ func buildFlagsWrapperToOptions(c *cobra.Command, contextDir string, flags *Buil
 	}
 
 	if flags.IgnoreFile != "" {
-		excludes, err := parseDockerignore(flags.IgnoreFile)
+		excludes, err := imagebuilder.ParseIgnore(flags.IgnoreFile)
 		if err != nil {
-			return nil, fmt.Errorf("unable to obtain decrypt config: %w", err)
+			return nil, fmt.Errorf("unable to parse ignore file: %w", err)
 		}
 		opts.Excludes = excludes
 	}
@@ -628,21 +629,6 @@ func getDecryptConfig(decryptionKeys []string) (*encconfig.DecryptConfig, error)
 	return decConfig, nil
 }
 
-func parseDockerignore(ignoreFile string) ([]string, error) {
-	excludes := []string{}
-	ignore, err := os.ReadFile(ignoreFile)
-	if err != nil {
-		return excludes, err
-	}
-	for _, e := range strings.Split(string(ignore), "\n") {
-		if len(e) == 0 || e[0] == '#' {
-			continue
-		}
-		excludes = append(excludes, e)
-	}
-	return excludes, nil
-}
-
 func areContainerfilesValid(contextDir string, containerFiles []string) error {
 	for _, f := range containerFiles {
 		if isURL(f) || f == "/dev/stdin" {

cmd/podman/common/create.go

@@ -627,7 +627,7 @@ func DefineCreateFlags(cmd *cobra.Command, cf *entities.ContainerCreateOptions,
 		createFlags.StringVar(
 			&cf.HealthTimeout,
 			healthTimeoutFlagName, define.DefaultHealthCheckTimeout,
-			"the maximum time allowed to complete the healthcheck before an interval is considered failed",
+			"the maximum time allowed to complete the healthcheck before an interval is considered failed and SIGKILL is sent to the healthcheck process",
 		)
 		_ = cmd.RegisterFlagCompletionFunc(healthTimeoutFlagName, completion.AutocompleteNone)
 

cmd/podman/containers/update.go

@@ -7,6 +7,7 @@ import (
 
 	"github.com/containers/podman/v5/cmd/podman/common"
 	"github.com/containers/podman/v5/cmd/podman/registry"
+	"github.com/containers/podman/v5/cmd/podman/validate"
 	"github.com/containers/podman/v5/libpod/define"
 	"github.com/containers/podman/v5/pkg/domain/entities"
 	"github.com/containers/podman/v5/pkg/specgen"
@@ -24,7 +25,7 @@ var (
 		Short:             "Update an existing container",
 		Long:              updateDescription,
 		RunE:              update,
-		Args:              cobra.ExactArgs(1),
+		Args:              validate.IDOrLatestArgs,
 		ValidArgsFunction: common.AutocompleteContainers,
 		Example:           `podman update --cpus=5 foobar_container`,
 	}
@@ -39,13 +40,17 @@ var (
 		Example:           `podman container update --cpus=5 foobar_container`,
 	}
 )
-var (
-	updateOpts entities.ContainerCreateOptions
-)
+
+type ContainerUpdateOptions struct {
+	entities.ContainerCreateOptions
+	Latest bool
+}
+
+var updateOptions ContainerUpdateOptions
 
 func updateFlags(cmd *cobra.Command) {
-	common.DefineCreateDefaults(&updateOpts)
-	common.DefineCreateFlags(cmd, &updateOpts, entities.UpdateMode)
+	common.DefineCreateDefaults(&updateOptions.ContainerCreateOptions)
+	common.DefineCreateFlags(cmd, &updateOptions.ContainerCreateOptions, entities.UpdateMode)
 }
 
 func init() {
@@ -53,12 +58,14 @@ func init() {
 		Command: updateCommand,
 	})
 	updateFlags(updateCommand)
+	validate.AddLatestFlag(updateCommand, &updateOptions.Latest)
 
 	registry.Commands = append(registry.Commands, registry.CliCommand{
 		Command: containerUpdateCommand,
 		Parent:  containerCmd,
 	})
 	updateFlags(containerUpdateCommand)
+	validate.AddLatestFlag(containerUpdateCommand, &updateOptions.Latest)
 }
 
 func GetChangedHealthCheckConfiguration(cmd *cobra.Command, vals *entities.ContainerCreateOptions) define.UpdateHealthCheckConfig {
@@ -129,12 +136,12 @@ func update(cmd *cobra.Command, args []string) error {
 	s := &specgen.SpecGenerator{}
 	s.ResourceLimits = &specs.LinuxResources{}
 
-	err = createOrUpdateFlags(cmd, &updateOpts)
+	err = createOrUpdateFlags(cmd, &updateOptions.ContainerCreateOptions)
 	if err != nil {
 		return err
 	}
 
-	s.ResourceLimits, err = specgenutil.GetResources(s, &updateOpts)
+	s.ResourceLimits, err = specgenutil.GetResources(s, &updateOptions.ContainerCreateOptions)
 	if err != nil {
 		return err
 	}
@@ -143,17 +150,21 @@ func update(cmd *cobra.Command, args []string) error {
 		s.ResourceLimits = &specs.LinuxResources{}
 	}
 
-	healthCheckConfig := GetChangedHealthCheckConfiguration(cmd, &updateOpts)
+	healthCheckConfig := GetChangedHealthCheckConfiguration(cmd, &updateOptions.ContainerCreateOptions)
 
 	opts := &entities.ContainerUpdateOptions{
-		NameOrID:                        strings.TrimPrefix(args[0], "/"),
 		Resources:                       s.ResourceLimits,
 		ChangedHealthCheckConfiguration: &healthCheckConfig,
 		DevicesLimits:                   GetChangedDeviceLimits(s),
+		Latest:                          updateOptions.Latest,
+	}
+
+	if !updateOptions.Latest {
+		opts.NameOrID = strings.TrimPrefix(args[0], "/")
 	}
 
 	if cmd.Flags().Changed("restart") {
-		policy, retries, err := util.ParseRestartPolicy(updateOpts.Restart)
+		policy, retries, err := util.ParseRestartPolicy(updateOptions.Restart)
 		if err != nil {
 			return err
 		}

cmd/podman/images/buildx_inspect.go

@@ -0,0 +1,81 @@
+package images
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/containers/podman/v5/cmd/podman/registry"
+	"github.com/spf13/cobra"
+)
+
+type buildNode struct {
+	Name            string
+	Endpoint        string
+	Status          string
+	BuildkitVersion string
+	Platforms       []string
+}
+
+type buildxInspectOutput struct {
+	builderName string
+	driverName  string
+	Nodes       []buildNode
+}
+
+var buildxInspectCmd = &cobra.Command{
+	Use:   "inspect",
+	Short: "Inspects build capabilities",
+	Long:  "Displays information about the current builder instance (compatibility with Docker buildx inspect)",
+	RunE:  runBuildxInspect,
+	Example: `podman buildx inspect
+	podman buildx inspect --bootstrap`,
+}
+
+func init() {
+	buildxInspectCmd.Flags().Bool("bootstrap", false, "Currently a No Op for podman")
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Command: buildxInspectCmd,
+		Parent:  buildxCmd,
+	})
+}
+
+func runBuildxInspect(cmd *cobra.Command, args []string) error {
+	info, err := registry.ContainerEngine().Info(registry.Context())
+
+	if err != nil {
+		return fmt.Errorf("retrieving podman information: %w", err)
+	}
+
+	nativePlatform := fmt.Sprintf("%s/%s", info.Host.OS, info.Host.Arch)
+
+	// Constants are based on default values for Docker buildx inspect.
+	defaultNode := buildNode{
+		Name:            "default",
+		Endpoint:        "default",
+		Status:          "running",
+		BuildkitVersion: "N/A",
+		Platforms:       []string{nativePlatform},
+	}
+
+	defaultNode.Platforms = append(defaultNode.Platforms, info.Host.EmulatedArchitectures...)
+
+	out := buildxInspectOutput{
+		builderName: "default",
+		driverName:  "podman",
+		Nodes:       []buildNode{defaultNode},
+	}
+
+	fmt.Printf("Name:   %s\n", out.builderName)
+	fmt.Printf("Driver: %s\n", out.driverName)
+	fmt.Println()
+
+	fmt.Println("Nodes:")
+	fmt.Printf("Name:             %s\n", out.Nodes[0].Name)
+	fmt.Printf("Endpoint:         %s\n", out.Nodes[0].Endpoint)
+	fmt.Printf("Status:           %s\n", out.Nodes[0].Status)
+	fmt.Printf("Buildkit version: %s\n", out.Nodes[0].BuildkitVersion)
+
+	fmt.Printf("Platforms:        %s\n", strings.Join(out.Nodes[0].Platforms, ", "))
+	fmt.Println("Labels: ")
+	return nil
+}

cmd/podman/images/import.go

@@ -130,7 +130,7 @@ func importCon(cmd *cobra.Command, args []string) error {
 	}
 
 	errFileName := parse.ValidateFileName(source)
-	errURL := parse.ValidURL(source)
+	errURL := parse.ValidWebURL(source)
 	if errURL == nil {
 		importOpts.SourceIsURL = true
 	}

cmd/podman/images/list.go

@@ -10,11 +10,11 @@ import (
 	"time"
 	"unicode"
 
-	"github.com/containers/common/pkg/completion"
 	"github.com/containers/common/pkg/report"
 	"github.com/containers/image/v5/docker/reference"
 	"github.com/containers/podman/v5/cmd/podman/common"
 	"github.com/containers/podman/v5/cmd/podman/registry"
+	"github.com/containers/podman/v5/cmd/podman/validate"
 	"github.com/containers/podman/v5/pkg/domain/entities"
 	"github.com/docker/go-units"
 	"github.com/spf13/cobra"
@@ -62,13 +62,6 @@ var (
 
 	// Options for presenting data
 	listFlag = listFlagType{}
-
-	sortFields = entities.NewStringSet(
-		"created",
-		"id",
-		"repository",
-		"size",
-		"tag")
 )
 
 func init() {
@@ -102,9 +95,18 @@ func imageListFlagSet(cmd *cobra.Command) {
 	flags.BoolVar(&listFlag.noTrunc, "no-trunc", false, "Do not truncate output")
 	flags.BoolVarP(&listFlag.quiet, "quiet", "q", false, "Display only image IDs")
 
+	// set default sort value
+	listFlag.sort = "created"
+	sort := validate.Value(&listFlag.sort,
+		"created",
+		"id",
+		"repository",
+		"size",
+		"tag",
+	)
 	sortFlagName := "sort"
-	flags.StringVar(&listFlag.sort, sortFlagName, "created", "Sort by "+sortFields.String())
-	_ = cmd.RegisterFlagCompletionFunc(sortFlagName, completion.AutocompleteNone)
+	flags.Var(sort, sortFlagName, "Sort by "+sort.Choices())
+	_ = cmd.RegisterFlagCompletionFunc(sortFlagName, common.AutocompleteImageSort)
 
 	flags.BoolVarP(&listFlag.history, "history", "", false, "Display the image name history")
 }
@@ -118,11 +120,6 @@ func images(cmd *cobra.Command, args []string) error {
 		listOptions.Filter = append(listOptions.Filter, "reference="+args[0])
 	}
 
-	if cmd.Flags().Changed("sort") && !sortFields.Contains(listFlag.sort) {
-		return fmt.Errorf("\"%s\" is not a valid field for sorting. Choose from: %s",
-			listFlag.sort, sortFields.String())
-	}
-
 	summaries, err := registry.ImageEngine().List(registry.Context(), listOptions)
 	if err != nil {
 		return err

cmd/podman/images/pull.go

@@ -9,6 +9,7 @@ import (
 	"github.com/containers/buildah/pkg/cli"
 	"github.com/containers/common/pkg/auth"
 	"github.com/containers/common/pkg/completion"
+	"github.com/containers/common/pkg/config"
 	"github.com/containers/image/v5/types"
 	"github.com/containers/podman/v5/cmd/podman/common"
 	"github.com/containers/podman/v5/cmd/podman/registry"
@@ -25,6 +26,7 @@ type pullOptionsWrapper struct {
 	TLSVerifyCLI   bool // CLI only
 	CredentialsCLI string
 	DecryptionKeys []string
+	PolicyCLI      string
 }
 
 var (
@@ -101,6 +103,11 @@ func pullFlags(cmd *cobra.Command) {
 	flags.String(platformFlagName, "", "Specify the platform for selecting the image.  (Conflicts with arch and os)")
 	_ = cmd.RegisterFlagCompletionFunc(platformFlagName, completion.AutocompleteNone)
 
+	policyFlagName := "policy"
+	// Explicitly set the default to "always" to avoid the default being "missing"
+	flags.StringVar(&pullOptions.PolicyCLI, policyFlagName, "always", `Pull image policy ("always"|"missing"|"never"|"newer")`)
+	_ = cmd.RegisterFlagCompletionFunc(policyFlagName, common.AutocompletePullOption)
+
 	flags.Bool("disable-content-trust", false, "This is a Docker specific option and is a NOOP")
 	flags.BoolVarP(&pullOptions.Quiet, "quiet", "q", false, "Suppress output information when pulling images")
 	flags.BoolVar(&pullOptions.TLSVerifyCLI, "tls-verify", true, "Require HTTPS and verify certificates when contacting registries")
@@ -143,6 +150,12 @@ func imagePull(cmd *cobra.Command, args []string) error {
 		pullOptions.SkipTLSVerify = types.NewOptionalBool(!pullOptions.TLSVerifyCLI)
 	}
 
+	pullPolicy, err := config.ParsePullPolicy(pullOptions.PolicyCLI)
+	if err != nil {
+		return err
+	}
+	pullOptions.PullPolicy = pullPolicy
+
 	if cmd.Flags().Changed("retry") {
 		retry, err := cmd.Flags().GetUint("retry")
 		if err != nil {

cmd/podman/kube/play.go

@@ -369,7 +369,7 @@ func readerFromArg(fileName string) (*bytes.Reader, error) {
 	switch {
 	case fileName == "-": // Read from stdin
 		reader = os.Stdin
-	case parse.ValidURL(fileName) == nil:
+	case parse.ValidWebURL(fileName) == nil:
 		response, err := http.Get(fileName)
 		if err != nil {
 			return nil, err

cmd/podman/machine/cp.go

@@ -95,7 +95,7 @@ func cp(_ *cobra.Command, args []string) error {
 	cpOpts.SrcPath = srcPath
 	cpOpts.DestPath = destPath
 
-	err = secureCopy(&cpOpts)
+	err = localhostSSHCopy(&cpOpts)
 	if err != nil {
 		return fmt.Errorf("copy failed: %s", err.Error())
 	}
@@ -105,7 +105,8 @@ func cp(_ *cobra.Command, args []string) error {
 	return nil
 }
 
-func secureCopy(opts *cpOptions) error {
+// localhostSSHCopy uses scp to copy files from/to a localhost machine using ssh.
+func localhostSSHCopy(opts *cpOptions) error {
 	srcPath := opts.SrcPath
 	destPath := opts.DestPath
 	sshConfig := opts.Machine.SSH
@@ -123,7 +124,7 @@ func secureCopy(opts *cpOptions) error {
 	}
 
 	args := []string{"-r", "-i", sshConfig.IdentityPath, "-P", strconv.Itoa(sshConfig.Port)}
-	args = append(args, machine.CommonSSHArgs()...)
+	args = append(args, machine.LocalhostSSHArgs()...) // Warning: This MUST NOT be generalized to allow communication over untrusted networks.
 	args = append(args, []string{srcPath, destPath}...)
 
 	cmd := exec.Command("scp", args...)

cmd/podman/machine/init.go

@@ -3,6 +3,7 @@
 package machine
 
 import (
+	"errors"
 	"fmt"
 	"os"
 
@@ -83,6 +84,14 @@ func init() {
 	)
 	_ = initCmd.RegisterFlagCompletionFunc(memoryFlagName, completion.AutocompleteNone)
 
+	swapFlagName := "swap"
+	flags.Uint64VarP(
+		&initOpts.Swap,
+		swapFlagName, "s", 0,
+		"Swap in MiB",
+	)
+	_ = initCmd.RegisterFlagCompletionFunc(swapFlagName, completion.AutocompleteNone)
+
 	flags.BoolVar(
 		&now,
 		"now", false,
@@ -224,6 +233,14 @@ func initMachine(cmd *cobra.Command, args []string) error {
 
 	err = shim.Init(initOpts, provider)
 	if err != nil {
+		// The installation is partially complete and podman should
+		// exit gracefully with no error and no success message.
+		// Examples:
+		// - a user has chosen to perform their own reboot
+		// - reexec for limited admin operations, returning to parent
+		if errors.Is(err, define.ErrInitRelaunchAttempt) {
+			return nil
+		}
 		return err
 	}
 

cmd/podman/machine/list.go

@@ -119,6 +119,7 @@ func outputTemplate(cmd *cobra.Command, responses []*entities.ListReporter) erro
 		"CPUs":     "CPUS",
 		"Memory":   "MEMORY",
 		"DiskSize": "DISK SIZE",
+		"Swap":     "SWAP",
 	})
 
 	rpt := report.New(os.Stdout, cmd.Name())
@@ -182,6 +183,7 @@ func toMachineFormat(vms []*machine.ListResponse, defaultCon *config.Connection)
 		response.VMType = vm.VMType
 		response.CPUs = vm.CPUs
 		response.Memory = strUint(uint64(vm.Memory.ToBytes()))
+		response.Swap = strUint(uint64(vm.Swap.ToBytes()))
 		response.DiskSize = strUint(uint64(vm.DiskSize.ToBytes()))
 		response.Port = vm.Port
 		response.RemoteUsername = vm.RemoteUsername
@@ -225,6 +227,7 @@ func toHumanFormat(vms []*machine.ListResponse, defaultCon *config.Connection) [
 		response.VMType = vm.VMType
 		response.CPUs = vm.CPUs
 		response.Memory = units.BytesSize(float64(vm.Memory.ToBytes()))
+		response.Swap = units.BytesSize(float64(vm.Swap.ToBytes()))
 		response.DiskSize = units.BytesSize(float64(vm.DiskSize.ToBytes()))
 
 		humanResponses = append(humanResponses, response)

cmd/podman/machine/ssh.go

@@ -115,6 +115,6 @@ func ssh(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	err = machine.CommonSSHShell(sshOpts.Username, mc.SSH.IdentityPath, mc.Name, mc.SSH.Port, sshOpts.Args)
+	err = machine.LocalhostSSHShell(sshOpts.Username, mc.SSH.IdentityPath, mc.Name, mc.SSH.Port, sshOpts.Args)
 	return utils.HandleOSExecError(err)
 }

cmd/podman/parse/net.go

@@ -157,14 +157,21 @@ func parseEnvOrLabelFile(envOrLabel map[string]string, filename, configType stri
 	return scanner.Err()
 }
 
-// ValidURL checks a string urlStr is a url or not
-func ValidURL(urlStr string) error {
-	url, err := url.ParseRequestURI(urlStr)
+// ValidWebURL checks a string urlStr is a url or not
+func ValidWebURL(urlStr string) error {
+	parsedURL, err := url.ParseRequestURI(urlStr)
 	if err != nil {
-		return fmt.Errorf("invalid url %q: %w", urlStr, err)
+		return fmt.Errorf("invalid URL %q: %w", urlStr, err)
 	}
-	if url.Scheme == "" {
-		return fmt.Errorf("invalid url %q: missing scheme", urlStr)
+
+	// to be a valid web url, scheme must be either http or https
+	if parsedURL.Scheme != "http" && parsedURL.Scheme != "https" {
+		return fmt.Errorf("invalid URL %q: unsupported scheme %q", urlStr, parsedURL.Scheme)
+	}
+
+	// ensure url contain a host
+	if parsedURL.Host == "" {
+		return fmt.Errorf("invalid URL %q: missing host", urlStr)
 	}
 	return nil
 }

cmd/podman/parse/net_test.go

@@ -158,3 +158,69 @@ func TestGetAllLabelsFile(t *testing.T) {
 	result, _ := GetAllLabels(fileLabels, Var1)
 	assert.Equal(t, len(result), 3)
 }
+
+func TestValidWebURL(t *testing.T) {
+	tests := []struct {
+		name    string
+		input   string
+		wantErr bool
+	}{
+		{
+			name:    "Valid HTTP URL",
+			input:   "http://example.com",
+			wantErr: false,
+		},
+		{
+			name:    "Valid HTTPS URL",
+			input:   "https://example.com",
+			wantErr: false,
+		},
+		{
+			name:    "Missing scheme",
+			input:   "example.com",
+			wantErr: true,
+		},
+		{
+			name:    "Unsupported scheme - FTP",
+			input:   "ftp://example.com",
+			wantErr: true,
+		},
+		{
+			name:    "Missing host",
+			input:   "https://",
+			wantErr: true,
+		},
+		{
+			name:    "Local file path - Windows style",
+			input:   "C:/hello/world",
+			wantErr: true,
+		},
+		{
+			name:    "Local file path - Unix style",
+			input:   "/usr/local/bin",
+			wantErr: true,
+		},
+		{
+			name:    "Invalid URL characters",
+			input:   "https://example.com/%%%",
+			wantErr: true,
+		},
+		{
+			name:    "Valid URL with port",
+			input:   "https://example.com:8080",
+			wantErr: false,
+		},
+		{
+			name:    "Valid URL with path",
+			input:   "https://example.com/path/to/resource",
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := ValidWebURL(tt.input)
+			assert.Equal(t, tt.wantErr, err != nil, "ValidWebURL(%q) = %v, wantErr %v", tt.input, err, tt.wantErr)
+		})
+	}
+}

cmd/podman/root.go

@@ -293,6 +293,34 @@ func persistentPreRunE(cmd *cobra.Command, args []string) error {
 				}
 			}
 		}
+
+		if cmd.Flag("cpu-profile").Changed {
+			f, err := os.Create(podmanConfig.CPUProfile)
+			if err != nil {
+				return err
+			}
+			if err := pprof.StartCPUProfile(f); err != nil {
+				return err
+			}
+		}
+		if cmd.Flag("memory-profile").Changed {
+			// Same value as the default in github.com/pkg/profile.
+			runtime.MemProfileRate = 4096
+			if rate := os.Getenv("MemProfileRate"); rate != "" {
+				r, err := strconv.Atoi(rate)
+				if err != nil {
+					return err
+				}
+				runtime.MemProfileRate = r
+			}
+		}
+
+		if podmanConfig.MaxWorks <= 0 {
+			return fmt.Errorf("maximum workers must be set to a positive number (got %d)", podmanConfig.MaxWorks)
+		}
+		if err := parallel.SetMaxThreads(uint(podmanConfig.MaxWorks)); err != nil {
+			return err
+		}
 	}
 
 	if err := readRemoteCliFlags(cmd, podmanConfig); err != nil {
@@ -346,35 +374,6 @@ func persistentPreRunE(cmd *cobra.Command, args []string) error {
 		}
 	}
 
-	if !registry.IsRemote() {
-		if cmd.Flag("cpu-profile").Changed {
-			f, err := os.Create(podmanConfig.CPUProfile)
-			if err != nil {
-				return err
-			}
-			if err := pprof.StartCPUProfile(f); err != nil {
-				return err
-			}
-		}
-		if cmd.Flag("memory-profile").Changed {
-			// Same value as the default in github.com/pkg/profile.
-			runtime.MemProfileRate = 4096
-			if rate := os.Getenv("MemProfileRate"); rate != "" {
-				r, err := strconv.Atoi(rate)
-				if err != nil {
-					return err
-				}
-				runtime.MemProfileRate = r
-			}
-		}
-
-		if podmanConfig.MaxWorks <= 0 {
-			return fmt.Errorf("maximum workers must be set to a positive number (got %d)", podmanConfig.MaxWorks)
-		}
-		if err := parallel.SetMaxThreads(uint(podmanConfig.MaxWorks)); err != nil {
-			return err
-		}
-	}
 	// Setup Rootless environment, IFF:
 	// 1) in ABI mode
 	// 2) running as non-root
@@ -675,7 +674,7 @@ func rootFlags(cmd *cobra.Command, podmanConfig *entities.PodmanConfig) {
 		pFlags.StringArrayVar(&podmanConfig.RuntimeFlags, runtimeflagFlagName, []string{}, "add global flags for the container runtime")
 		_ = rootCmd.RegisterFlagCompletionFunc(runtimeflagFlagName, completion.AutocompleteNone)
 
-		pFlags.BoolVar(&podmanConfig.Syslog, "syslog", false, "Output logging information to syslog as well as the console (default false)")
+		pFlags.BoolVar(&podmanConfig.Syslog, "syslog", false, "Output podman-internal logs to syslog as well as the console (default false)")
 	}
 }
 

cmd/podman/secrets/create.go

@@ -57,6 +57,8 @@ func init() {
 
 	flags.BoolVar(&createOpts.Replace, "replace", false, "If a secret with the same name exists, replace it")
 
+	flags.BoolVar(&createOpts.Ignore, "ignore", false, "If a secret with the same name exists, ignore and do not create a new secret")
+
 	labelFlagName := "label"
 	flags.StringArrayVarP(&labels, labelFlagName, "l", nil, "Specify labels on the secret")
 	_ = createCmd.RegisterFlagCompletionFunc(labelFlagName, completion.AutocompleteNone)
@@ -65,6 +67,11 @@ func init() {
 func create(cmd *cobra.Command, args []string) error {
 	name := args[0]
 
+	// Validate that --ignore and --replace are not used together
+	if createOpts.Ignore && createOpts.Replace {
+		return errors.New("cannot use --ignore and --replace flags together")
+	}
+
 	var err error
 	path := args[1]
 

cmd/podman/system/check.go

@@ -64,8 +64,11 @@ func check(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	if !checkOptions.Repair && !checkOptions.RepairLossy && response.Errors {
-		return errors.New("damage detected in local storage")
+	if !checkOptions.Repair && !checkOptions.RepairLossy {
+		if response.Errors {
+			return errors.New("damage detected in local storage")
+		}
+		return nil
 	}
 
 	recheckOptions := checkOptions

cmd/podman/system/df.go

@@ -275,7 +275,10 @@ func (d *dfContainer) ContainerID() string {
 }
 
 func (d *dfContainer) Image() string {
-	return d.SystemDfContainerReport.Image[0:12]
+	if len(d.SystemDfContainerReport.Image) >= 12 {
+		return d.SystemDfContainerReport.Image[0:12]
+	}
+	return ""
 }
 
 func (d *dfContainer) Command() string {

cmd/podman/validate/args.go

@@ -50,20 +50,6 @@ func IDOrLatestArgs(cmd *cobra.Command, args []string) error {
 	return nil
 }
 
-// CheckAllLatestAndCIDFile checks that --all and --latest are used correctly for containers and pods
-// If idFileFlag is set, also checks for the --cidfile or --pod-id-file flag.
-// Note: this has been deprecated, use CheckAllLatestAndIDFile instead
-func CheckAllLatestAndCIDFile(c *cobra.Command, args []string, ignoreArgLen bool, cidfile bool) error {
-	return CheckAllLatestAndIDFile(c, args, ignoreArgLen, "cidfile")
-}
-
-// CheckAllLatestAndPodIDFile checks that --all and --latest are used correctly.
-// If withIDFile is set, also check for the --pod-id-file flag.
-// Note: this has been deprecated, use CheckAllLatestAndIDFile instead
-func CheckAllLatestAndPodIDFile(c *cobra.Command, args []string, ignoreArgLen bool, withIDFile bool) error {
-	return CheckAllLatestAndIDFile(c, args, ignoreArgLen, "pod-id-file")
-}
-
 // CheckAllLatestAndIDFile checks that --all and --latest are used correctly for containers and pods
 // If idFileFlag is set, also checks for the --cidfile or --pod-id-file flag.
 func CheckAllLatestAndIDFile(c *cobra.Command, args []string, ignoreArgLen bool, idFileFlag string) error {

cmd/podman/volumes/create.go

@@ -23,7 +23,8 @@ var (
 		ValidArgsFunction: completion.AutocompleteNone,
 		Example: `podman volume create myvol
   podman volume create
-  podman volume create --label foo=bar myvol`,
+  podman volume create --label foo=bar myvol
+  podman volume create --uid 4321 --gid 1234 myvol`,
 	}
 )
 
@@ -33,6 +34,8 @@ var (
 		Label  []string
 		Opts   []string
 		Ignore bool
+		UID    int
+		GID    int
 	}{}
 )
 
@@ -57,6 +60,14 @@ func init() {
 
 	ignoreFlagName := "ignore"
 	flags.BoolVar(&opts.Ignore, ignoreFlagName, false, "Don't fail if volume already exists")
+
+	uidFlagName := "uid"
+	flags.IntVar(&opts.UID, uidFlagName, 0, "Set the UID of the volume owner")
+	_ = createCommand.RegisterFlagCompletionFunc(uidFlagName, completion.AutocompleteNone)
+
+	gidFlagName := "gid"
+	flags.IntVar(&opts.GID, gidFlagName, 0, "Set the GID of the volume owner")
+	_ = createCommand.RegisterFlagCompletionFunc(gidFlagName, completion.AutocompleteNone)
 }
 
 func create(cmd *cobra.Command, args []string) error {
@@ -77,6 +88,12 @@ func create(cmd *cobra.Command, args []string) error {
 	if err != nil {
 		return fmt.Errorf("unable to process options: %w", err)
 	}
+	if cmd.Flags().Changed("uid") {
+		createOpts.UID = &opts.UID
+	}
+	if cmd.Flags().Changed("gid") {
+		createOpts.GID = &opts.GID
+	}
 	response, err := registry.ContainerEngine().VolumeCreate(context.Background(), createOpts)
 	if err != nil {
 		return err

cmd/podman/volumes/export.go

@@ -4,15 +4,14 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"os"
 
 	"github.com/containers/common/pkg/completion"
 	"github.com/containers/podman/v5/cmd/podman/common"
 	"github.com/containers/podman/v5/cmd/podman/registry"
 	"github.com/containers/podman/v5/pkg/domain/entities"
-	"github.com/containers/podman/v5/pkg/errorhandling"
-	"github.com/containers/podman/v5/utils"
-	"github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"golang.org/x/term"
 )
 
 var (
@@ -21,7 +20,6 @@ podman volume export
 
 Allow content of volume to be exported into external tar.`
 	exportCommand = &cobra.Command{
-		Annotations:       map[string]string{registry.EngineMode: registry.ABIMode},
 		Use:               "export [options] VOLUME",
 		Short:             "Export volumes",
 		Args:              cobra.ExactArgs(1),
@@ -32,10 +30,7 @@ Allow content of volume to be exported into external tar.`
 )
 
 var (
-	// Temporary struct to hold cli values.
-	cliExportOpts = struct {
-		Output string
-	}{}
+	targetPath string
 )
 
 func init() {
@@ -46,54 +41,31 @@ func init() {
 	flags := exportCommand.Flags()
 
 	outputFlagName := "output"
-	flags.StringVarP(&cliExportOpts.Output, outputFlagName, "o", "/dev/stdout", "Write to a specified file (default: stdout, which must be redirected)")
+	flags.StringVarP(&targetPath, outputFlagName, "o", "", "Write to a specified file (default: stdout, which must be redirected)")
 	_ = exportCommand.RegisterFlagCompletionFunc(outputFlagName, completion.AutocompleteDefault)
 }
 
 func export(cmd *cobra.Command, args []string) error {
-	var inspectOpts entities.InspectOptions
 	containerEngine := registry.ContainerEngine()
 	ctx := context.Background()
+	exportOpts := entities.VolumeExportOptions{}
 
-	if cliExportOpts.Output == "" {
-		return errors.New("expects output path, use --output=[path]")
-	}
-	inspectOpts.Type = common.VolumeType
-	volumeData, errs, err := containerEngine.VolumeInspect(ctx, args, inspectOpts)
-	if err != nil {
-		return err
-	}
-	if len(errs) > 0 {
-		return errorhandling.JoinErrors(errs)
-	}
-	if len(volumeData) < 1 {
-		return errors.New("no volume data found")
-	}
-	mountPoint := volumeData[0].VolumeConfigResponse.Mountpoint
-	driver := volumeData[0].VolumeConfigResponse.Driver
-	volumeOptions := volumeData[0].VolumeConfigResponse.Options
-	volumeMountStatus, err := containerEngine.VolumeMounted(ctx, args[0])
-	if err != nil {
-		return err
-	}
-	if mountPoint == "" {
-		return errors.New("volume is not mounted anywhere on host")
-	}
-	// Check if volume is using external plugin and export only if volume is mounted
-	if driver != "" && driver != "local" {
-		if !volumeMountStatus.Value {
-			return fmt.Errorf("volume is using a driver %s and volume is not mounted on %s", driver, mountPoint)
+	if targetPath != "" {
+		targetFile, err := os.Create(targetPath)
+		if err != nil {
+			return fmt.Errorf("unable to create target file path %q: %w", targetPath, err)
 		}
-	}
-	// Check if volume is using `local` driver and has mount options type other than tmpfs
-	if driver == "local" {
-		if mountOptionType, ok := volumeOptions["type"]; ok {
-			if mountOptionType != "tmpfs" && !volumeMountStatus.Value {
-				return fmt.Errorf("volume is using a driver %s and volume is not mounted on %s", driver, mountPoint)
-			}
+		defer targetFile.Close()
+		exportOpts.Output = targetFile
+	} else {
+		if cmd.Flag("output").Changed {
+			return errors.New("must provide valid path for file to write to")
 		}
+		if term.IsTerminal(int(os.Stdout.Fd())) {
+			return errors.New("cannot write to terminal, use command-line redirection or the --output flag")
+		}
+		exportOpts.Output = os.Stdout
 	}
-	logrus.Debugf("Exporting volume data from %s to %s", mountPoint, cliExportOpts.Output)
-	err = utils.CreateTarFromSrc(mountPoint, cliExportOpts.Output)
-	return err
+
+	return containerEngine.VolumeExport(ctx, args[0], exportOpts)
 }

cmd/podman/volumes/import.go

@@ -1,7 +1,7 @@
 package volumes
 
 import (
-	"errors"
+	"context"
 	"fmt"
 	"os"
 
@@ -9,15 +9,12 @@ import (
 	"github.com/containers/podman/v5/cmd/podman/parse"
 	"github.com/containers/podman/v5/cmd/podman/registry"
 	"github.com/containers/podman/v5/pkg/domain/entities"
-	"github.com/containers/podman/v5/pkg/errorhandling"
-	"github.com/containers/podman/v5/utils"
 	"github.com/spf13/cobra"
 )
 
 var (
 	importDescription = `Imports contents into a podman volume from specified tarball (.tar, .tar.gz, .tgz, .bzip, .tar.xz, .txz).`
 	importCommand     = &cobra.Command{
-		Annotations:       map[string]string{registry.EngineMode: registry.ABIMode},
 		Use:               "import VOLUME [SOURCE]",
 		Short:             "Import a tarball contents into a podman volume",
 		Long:              importDescription,
@@ -37,65 +34,26 @@ func init() {
 }
 
 func importVol(cmd *cobra.Command, args []string) error {
-	var inspectOpts entities.InspectOptions
-	var tarFile *os.File
-	containerEngine := registry.ContainerEngine()
-	ctx := registry.Context()
-	// create a slice of volumes since inspect expects slice as arg
-	volumes := []string{args[0]}
-	tarPath := args[1]
+	opts := entities.VolumeImportOptions{}
 
-	if tarPath != "-" {
-		err := parse.ValidateFileName(tarPath)
-		if err != nil {
-			return err
-		}
-
-		// open tar file
-		tarFile, err = os.Open(tarPath)
-		if err != nil {
-			return err
-		}
+	filepath := args[1]
+	if filepath == "-" {
+		opts.Input = os.Stdin
 	} else {
-		tarFile = os.Stdin
+		if err := parse.ValidateFileName(filepath); err != nil {
+			return err
+		}
+
+		targetFile, err := os.Open(filepath)
+		if err != nil {
+			return fmt.Errorf("unable open input file: %w", err)
+		}
+		defer targetFile.Close()
+		opts.Input = targetFile
 	}
 
-	inspectOpts.Type = common.VolumeType
-	inspectOpts.Type = common.VolumeType
-	volumeData, errs, err := containerEngine.VolumeInspect(ctx, volumes, inspectOpts)
-	if err != nil {
-		return err
-	}
-	if len(errs) > 0 {
-		return errorhandling.JoinErrors(errs)
-	}
-	if len(volumeData) < 1 {
-		return errors.New("no volume data found")
-	}
-	mountPoint := volumeData[0].VolumeConfigResponse.Mountpoint
-	driver := volumeData[0].VolumeConfigResponse.Driver
-	volumeOptions := volumeData[0].VolumeConfigResponse.Options
-	volumeMountStatus, err := containerEngine.VolumeMounted(ctx, args[0])
-	if err != nil {
-		return err
-	}
-	if mountPoint == "" {
-		return errors.New("volume is not mounted anywhere on host")
-	}
-	// Check if volume is using external plugin and export only if volume is mounted
-	if driver != "" && driver != "local" {
-		if !volumeMountStatus.Value {
-			return fmt.Errorf("volume is using a driver %s and volume is not mounted on %s", driver, mountPoint)
-		}
-	}
-	// Check if volume is using `local` driver and has mount options type other than tmpfs
-	if driver == "local" {
-		if mountOptionType, ok := volumeOptions["type"]; ok {
-			if mountOptionType != "tmpfs" && !volumeMountStatus.Value {
-				return fmt.Errorf("volume is using a driver %s and volume is not mounted on %s", driver, mountPoint)
-			}
-		}
-	}
-	// dont care if volume is mounted or not we are gonna import everything to mountPoint
-	return utils.UntarToFileSystem(mountPoint, tarFile, nil)
+	containerEngine := registry.ContainerEngine()
+	ctx := context.Background()
+
+	return containerEngine.VolumeImport(ctx, args[0], opts)
 }

cmd/podman/volumes/prune.go

@@ -64,9 +64,6 @@ func prune(cmd *cobra.Command, args []string) error {
 	if !force {
 		reader := bufio.NewReader(os.Stdin)
 		fmt.Println("WARNING! This will remove all volumes not used by at least one container. The following volumes will be removed:")
-		if err != nil {
-			return err
-		}
 		listOptions.Filter, err = parse.FilterArgumentsIntoFilters(filter)
 		if err != nil {
 			return err

cmd/quadlet/main.go

@@ -574,6 +574,20 @@ func warnIfAmbiguousName(unit *parser.UnitFile, group string) {
 	}
 }
 
+// Warns if the unit has any properties defined in the Service group that are known to cause issues.
+// We want to warn instead of erroring to avoid breaking any existing users' units,
+// or to allow users to use these properties if they know what they are doing.
+// We implement this here instead of in quadlet.initServiceUnitFile to avoid
+// having to refactor a large amount of code in the generator just for a warning.
+func warnIfUnsupportedServiceKeys(unit *parser.UnitFile) {
+	for _, key := range quadlet.UnsupportedServiceKeys {
+		_, hasKey := unit.Lookup(quadlet.ServiceGroup, key)
+		if hasKey {
+			Logf("Warning: using key %s in the Service group is not supported - use at your own risk", key)
+		}
+	}
+}
+
 func generateUnitsInfoMap(units []*parser.UnitFile) map[string]*quadlet.UnitInfo {
 	unitsInfoMap := make(map[string]*quadlet.UnitInfo)
 	for _, unit := range units {
@@ -604,6 +618,9 @@ func generateUnitsInfoMap(units []*parser.UnitFile) map[string]*quadlet.UnitInfo
 		case strings.HasSuffix(unit.Filename, ".pod"):
 			serviceName = quadlet.GetPodServiceName(unit)
 			containers = make([]string, 0)
+			// Prefill resouceNames for .pod files.
+			// This is requires for referencing the pod from .container files
+			resourceName = quadlet.GetPodResourceName(unit)
 		default:
 			Logf("Unsupported file type %q", unit.Filename)
 			continue
@@ -719,6 +736,8 @@ func process() bool {
 		var service *parser.UnitFile
 		var warnings, err error
 
+		warnIfUnsupportedServiceKeys(unit)
+
 		switch {
 		case strings.HasSuffix(unit.Filename, ".container"):
 			warnIfAmbiguousName(unit, quadlet.ContainerGroup)
@@ -736,7 +755,7 @@ func process() bool {
 		case strings.HasSuffix(unit.Filename, ".build"):
 			service, warnings, err = quadlet.ConvertBuild(unit, unitsInfoMap, isUserFlag)
 		case strings.HasSuffix(unit.Filename, ".pod"):
-			service, err = quadlet.ConvertPod(unit, unit.Filename, unitsInfoMap, isUserFlag)
+			service, warnings, err = quadlet.ConvertPod(unit, unit.Filename, unitsInfoMap, isUserFlag)
 		default:
 			Logf("Unsupported file type %q", unit.Filename)
 			continue

cni/87-podman-bridge.conflist

@@ -1,37 +0,0 @@
-{
-  "cniVersion": "0.4.0",
-  "name": "podman",
-  "plugins": [
-    {
-      "type": "bridge",
-      "bridge": "cni-podman0",
-      "isGateway": true,
-      "ipMasq": true,
-      "hairpinMode": true,
-      "ipam": {
-        "type": "host-local",
-        "routes": [{ "dst": "0.0.0.0/0" }],
-        "ranges": [
-          [
-            {
-              "subnet": "10.88.0.0/16",
-              "gateway": "10.88.0.1"
-            }
-          ]
-        ]
-      }
-    },
-    {
-      "type": "portmap",
-      "capabilities": {
-        "portMappings": true
-      }
-    },
-    {
-      "type": "firewall"
-    },
-    {
-      "type": "tuning"
-    }
-  ]
-}

cni/README.md

@@ -1,20 +0,0 @@
-## `cni` ##
-
-**Note**: The CNI backend is deprecated and will be removed in the next major Podman version 5.0, in preference
-of Netavark, see **[podman-network(1)](../docs/source/markdown/podman-network.1.md)** on how to change the backend.
-
-There are a wide variety of different [CNI](https://github.com/containernetworking/cni) network configurations. This
-directory just contains an example configuration that can be used as the
-basis for your own configuration.
-
-To use this configuration, place it in `/etc/cni/net.d` (or the directory
-specified by `cni_config_dir` in your `containers.conf`).
-
-For example a basic network configuration can be achieved with:
-
-```bash
-sudo mkdir -p /etc/cni/net.d
-curl -qsSL https://raw.githubusercontent.com/containers/podman/main/cni/87-podman-bridge.conflist | sudo tee /etc/cni/net.d/87-podman-bridge.conflist
-```
-
-Dependent upon your CNI configuration, you will need to install as a minimum the `port` and `bridge`  [CNI plugins](https://github.com/containernetworking/plugins) into `/opt/cni/bin` (or the directory specified by `cni_plugin_dir` in containers.conf).  Please refer to the [CNI](https://github.com/containernetworking) project page in GitHub for more information.

contrib/cirrus/setup_environment.sh

@@ -209,6 +209,12 @@ mount -t tmpfs -o size=75%,mode=0700 none /var/lib/containers
 showrun echo "Setting CI_DESIRED_STORAGE [=$CI_DESIRED_STORAGE] for *e2e* tests"
 echo "STORAGE_FS=$CI_DESIRED_STORAGE" >>/etc/ci_environment
 
+if ((CONTAINER==0)); then  # not yet inside a container
+    # Load null_blk to use /dev/nullb0 for testing block
+    # devices limits
+    modprobe null_blk nr_devices=1 || :
+fi
+
 # Required to be defined by caller: The environment where primary testing happens
 # shellcheck disable=SC2154
 showrun echo "about to set up for TEST_ENVIRON [=$TEST_ENVIRON]"

contrib/cirrus/win-collect-wsl-logs-start.ps1

@@ -0,0 +1,108 @@
+#    MIT License
+#
+#    Copyright (c) Microsoft Corporation.
+#
+#    Permission is hereby granted, free of charge, to any person obtaining a copy
+#    of this software and associated documentation files (the "Software"), to deal
+#    in the Software without restriction, including without limitation the rights
+#    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+#    copies of the Software, and to permit persons to whom the Software is
+#    furnished to do so, subject to the following conditions:
+#
+#    The above copyright notice and this permission notice shall be included in all
+#    copies or substantial portions of the Software.
+#
+#    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+#    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+#    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+#    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+#    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+#    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+#    SOFTWARE
+
+# This script is an adapted version of
+# https://github.com/Microsoft/WSL/blob/master/diagnostics/collect-wsl-logs.ps1
+
+#Requires -RunAsAdministrator
+
+[CmdletBinding()]
+Param (
+    $LogProfile = $null
+   )
+
+Set-StrictMode -Version Latest
+
+$folder = "WslLogs" + (Get-Date -Format "yyyy-MM-dd_HH-mm-ss")
+mkdir -p $folder | Out-Null
+
+if ($LogProfile -eq $null -Or ![System.IO.File]::Exists($LogProfile))
+{
+    if ($LogProfile -eq $null)
+    {
+        $url = "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/wsl.wprp"
+    }
+    elseif ($LogProfile -eq "storage")
+    {
+         $url = "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/wsl_storage.wprp"
+    }
+    else
+    {
+        Write-Error "Unknown log profile: $LogProfile"
+        exit 1
+    }
+
+    $LogProfile = "$folder/wsl.wprp"
+    try {
+        Invoke-WebRequest -UseBasicParsing $url -OutFile $LogProfile
+    }
+    catch {
+        throw
+    }
+}
+
+reg.exe export HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Lxss $folder/HKCU.txt 2>&1 | Out-Null
+reg.exe export HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Lxss $folder/HKLM.txt 2>&1 | Out-Null
+reg.exe export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\P9NP $folder/P9NP.txt 2>&1 | Out-Null
+reg.exe export HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinSock2 $folder/Winsock2.txt 2>&1 | Out-Null
+# Skipping the next reg.exe command because it's failing with error
+#    "ERROR: The system was unable to find the specified registry key or value"
+# on the CI server (Windows Server 2022)
+# reg.exe export "HKEY_CLASSES_ROOT\CLSID\{e66b0f30-e7b4-4f8c-acfd-d100c46c6278}" $folder/wslsupport-proxy.txt 2>&1 | Out-Null
+reg.exe export "HKEY_CLASSES_ROOT\CLSID\{a9b7a1b9-0671-405c-95f1-e0612cb4ce7e}" $folder/wslsupport-impl.txt 2>&1 | Out-Null
+Get-ItemProperty -Path "Registry::HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" > $folder/windows-version.txt
+
+Get-Service wslservice -ErrorAction Ignore | Format-list * -Force  > $folder/wslservice.txt
+
+$wslconfig = "$env:USERPROFILE/.wslconfig"
+if (Test-Path $wslconfig)
+{
+    Copy-Item $wslconfig $folder | Out-Null
+}
+
+get-appxpackage MicrosoftCorporationII.WindowsSubsystemforLinux -ErrorAction Ignore > $folder/appxpackage.txt
+get-acl "C:\ProgramData\Microsoft\Windows\WindowsApps" -ErrorAction Ignore | Format-List > $folder/acl.txt
+Get-WindowsOptionalFeature -Online > $folder/optional-components.txt
+bcdedit.exe > $folder/bcdedit.txt
+
+$uninstallLogs = "$env:TEMP/wsl-uninstall-logs.txt"
+if (Test-Path $uninstallLogs)
+{
+    Copy-Item $uninstallLogs $folder | Out-Null
+}
+
+$wprOutputLog = "$folder/wpr.txt"
+
+wpr.exe -start $LogProfile -filemode 2>&1 >> $wprOutputLog
+if ($LastExitCode -Ne 0)
+{
+    Write-Host -ForegroundColor Yellow "Log collection failed to start (exit code: $LastExitCode), trying to reset it."
+    wpr.exe -cancel 2>&1 >> $wprOutputLog
+
+    wpr.exe -start $LogProfile -filemode 2>&1 >> $wprOutputLog
+    if ($LastExitCode -Ne 0)
+    {
+        Write-Host -ForegroundColor Red "Couldn't start log collection (exitCode: $LastExitCode)"
+    }
+}
+
+Write-Host "`nWSL Log collection is running."

contrib/cirrus/win-collect-wsl-logs-stop.ps1

@@ -0,0 +1,45 @@
+#    MIT License
+#
+#    Copyright (c) Microsoft Corporation.
+#
+#    Permission is hereby granted, free of charge, to any person obtaining a copy
+#    of this software and associated documentation files (the "Software"), to deal
+#    in the Software without restriction, including without limitation the rights
+#    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+#    copies of the Software, and to permit persons to whom the Software is
+#    furnished to do so, subject to the following conditions:
+#
+#    The above copyright notice and this permission notice shall be included in all
+#    copies or substantial portions of the Software.
+#
+#    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+#    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+#    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+#    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+#    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+#    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+#    SOFTWARE
+
+# This script is an adapted version of
+# https://github.com/Microsoft/WSL/blob/master/diagnostics/collect-wsl-logs.ps1
+
+#Requires -RunAsAdministrator
+
+Set-StrictMode -Version Latest
+
+# get the directory that has a name that starts with WslLogs
+$folder = Get-ChildItem -Directory | Where-Object { $_.Name -like "WslLogs*" } | Select-Object -First 1
+$wprOutputLog = "$folder/wpr.txt"
+
+Write-Host "Saving WSL logs..."
+wpr.exe -stop $folder/logs.etl 2>&1 >> $wprOutputLog
+
+$logArchive = "$(Resolve-Path $folder).zip"
+Compress-Archive -Path $folder -DestinationPath $logArchive
+Remove-Item $folder -Recurse
+
+$fileName = (Get-Item $logArchive).Name
+$parentFolder = (Get-Item $logArchive).Directory.Parent.FullName
+Move-Item -Path $logArchive -Destination $parentFolder
+
+Write-Host -ForegroundColor Green "Logs saved in: ${parentFolder}/${fileName}"

contrib/cirrus/win-podman-machine-test.ps1

@@ -41,4 +41,15 @@ $Env:TMP = 'Z:\'
 $Env:TEMP = 'Z:\'
 
 Write-Host "`nRunning podman-machine e2e tests"
-Run-Command ".\winmake localmachine"
+
+if ($Env:TEST_FLAVOR -eq "machine-wsl") {
+    Run-Command "$PSScriptRoot\win-collect-wsl-logs-start.ps1"
+}
+
+try {
+    Run-Command ".\winmake localmachine"
+} finally {
+    if ($Env:TEST_FLAVOR -eq "machine-wsl") {
+        Run-Command "$PSScriptRoot\win-collect-wsl-logs-stop.ps1"
+    }
+}

contrib/containers-common/containers-common.sh

@@ -1,56 +0,0 @@
-#!/usr/bin/bash -e
-#
-# Script used for downloading man pages and config files from
-# github.com/containers libraries (storage, common, image)
-#
-# Must be run from directory containing input specfile
-#
-
-die() {
-    echo "$(basename $0): $*" >&2
-    exit 1
-}
-
-branchversion() {
-    gomod=$(git rev-parse --show-toplevel)/go.mod
-    v=$(awk -v X=github.com/containers/$1 '$1 ~ X { print $2 }' <$gomod)
-    hash=$(expr "$v" : "v.*-[0-9.]\+-\([0-9a-f]\+\)")
-    if [[ -n "$hash" ]]; then
-        v="$hash"
-    fi
-    echo "$v"
-}
-
-
-SPECFILE=containers-common.spec
-if [[ ! -e $SPECFILE.in ]]; then
-    die "Please run me from the same directory as $SPECFILE.in"
-fi
-
-declare -A moduleversion
-for module in common image storage; do
-    v=$(branchversion $module)
-    if [[ -z "$v" ]]; then
-        die "Could not find version for module '$v'"
-    fi
-    moduleversion[$module]=$v
-done
-
-builddir=containers-common-${moduleversion[common]}
-mkdir -p $builddir
-
-sed -e "s/COMMON_BRANCH/${moduleversion[common]}/g" \
-    -e "s/IMAGE_BRANCH/${moduleversion[image]}/g"  \
-    -e "s/STORAGE_BRANCH/${moduleversion[storage]}/g"  \
-    <$SPECFILE.in >$builddir/$SPECFILE
-
-cd $builddir
-spectool -fg $SPECFILE
-
-if [[ ! -e storage.conf ]]; then
-    die "spectool did not pull storage.conf"
-fi
-
-echo "Changing storage.conf..."
-sed -i -e 's/^driver.*=.*/driver = "overlay"/' -e 's/^mountopt.*=.*/mountopt = "nodev,metacopy=on"/' \
-        storage.conf

contrib/containers-common/containers-common.spec.in

@@ -1,175 +0,0 @@
-# Below definitions are used to deliver config files from a particular branch
-# of c/image, c/common, c/storage vendored in all of Buildah, Podman and Skopeo.
-# These vendored components must have the same version. If it is not the case,
-# pick the oldest version on c/image, c/common, c/storage vendored in
-# Buildah/Podman/Skopeo.
-%global skopeo_branch main
-%global image_branch  IMAGE_BRANCH
-%global common_branch COMMON_BRANCH
-%global storage_branch STORAGE_BRANCH
-%global shortnames_branch main
-
-%global github_containers https://raw.githubusercontent.com/containers
-
-Epoch: 4
-Name: containers-common
-Version: COMMON_BRANCH
-Release: %autorelease
-Summary: Common configuration and documentation for containers
-License: ASL 2.0
-BuildArch: noarch
-BuildRequires: go-md2man
-Provides: skopeo-containers = %{epoch}:%{version}-%{release}
-Requires: (container-selinux >= 2:2.162.1 if selinux-policy)
-Requires: oci-runtime
-Requires: container-network-stack
-Recommends: netavark
-Recommends: fuse-overlayfs
-Recommends: slirp4netns
-Source1: %{github_containers}/common/%{common_branch}/docs/containers.conf.5.md
-Source2: %{github_containers}/common/%{common_branch}/pkg/config/containers.conf
-Source3: %{github_containers}/common/%{common_branch}/pkg/seccomp/seccomp.json
-Source4: %{github_containers}/common/%{common_branch}/pkg/subscriptions/mounts.conf
-Source5: %{github_containers}/image/%{image_branch}/docs/containers-auth.json.5.md
-Source6: %{github_containers}/image/%{image_branch}/docs/containers-certs.d.5.md
-Source7: %{github_containers}/image/%{image_branch}/docs/containers-policy.json.5.md
-Source8: %{github_containers}/image/%{image_branch}/docs/containers-registries.conf.5.md
-Source9: %{github_containers}/image/%{image_branch}/docs/containers-registries.conf.d.5.md
-Source10: %{github_containers}/image/%{image_branch}/docs/containers-registries.d.5.md
-Source11: %{github_containers}/image/%{image_branch}/docs/containers-signature.5.md
-Source12: %{github_containers}/image/%{image_branch}/docs/containers-transports.5.md
-Source13: %{github_containers}/image/%{image_branch}/registries.conf
-Source14: %{github_containers}/common/%{common_branch}/docs/containers-mounts.conf.5.md
-Source15: %{github_containers}/shortnames/%{shortnames_branch}/shortnames.conf
-Source16: %{github_containers}/skopeo/%{skopeo_branch}/default.yaml
-Source17: %{github_containers}/skopeo/%{skopeo_branch}/default-policy.json
-Source18: %{github_containers}/storage/%{storage_branch}/docs/containers-storage.conf.5.md
-Source19: %{github_containers}/storage/%{storage_branch}/storage.conf
-Source20: RPM-GPG-KEY-redhat-release
-Source21: registry.access.redhat.com.yaml
-Source22: registry.redhat.io.yaml
-Source23: %{github_containers}/common/%{common_branch}/docs/Containerfile.5.md
-Source24: %{github_containers}/common/%{common_branch}/docs/containerignore.5.md
-Source25: %{github_containers}/common/%{common_branch}/docs/links/.containerignore.5
-
-%description
-This package contains common configuration files and documentation for container
-tools ecosystem, such as Podman, Buildah and Skopeo.
-
-It is required because the most of configuration files and docs come from projects
-which are vendored into Podman, Buildah, Skopeo, etc. but they are not packaged
-separately.
-
-%prep
-cp %{SOURCE1} .
-cp %{SOURCE2} .
-cp %{SOURCE3} .
-cp %{SOURCE4} .
-cp %{SOURCE5} .
-cp %{SOURCE6} .
-cp %{SOURCE7} .
-cp %{SOURCE8} .
-cp %{SOURCE9} .
-cp %{SOURCE10} .
-cp %{SOURCE11} .
-cp %{SOURCE12} .
-cp %{SOURCE13} .
-cp %{SOURCE14} .
-cp %{SOURCE15} 000-shortnames.conf
-cp %{SOURCE16} .
-cp %{SOURCE17} policy.json
-cp %{SOURCE18} .
-cp %{SOURCE19} .
-cp %{SOURCE20} .
-cp %{SOURCE21} .
-cp %{SOURCE22} .
-cp %{SOURCE23} .
-cp %{SOURCE24} .
-cp %{SOURCE25} .
-
-%build
-mkdir -p man5
-for FILE in $(ls *.5.md); do
-    go-md2man -in $FILE -out man5/$(basename $FILE .md)
-done
-
-cp man5/containerignore.5 man5/.containerignore.5
-
-%install
-# install config and policy files for registries
-install -dp %{buildroot}%{_sysconfdir}/containers/{certs.d,oci/hooks.d}
-install -dp %{buildroot}%{_sharedstatedir}/containers/sigstore
-install -Dp -m0644 default.yaml -t %{buildroot}%{_sysconfdir}/containers/registries.d
-install -Dp -m0644 storage.conf -t %{buildroot}%{_datadir}/containers
-install -Dp -m0644 registries.conf -t %{buildroot}%{_sysconfdir}/containers
-install -Dp -m0644 000-shortnames.conf -t %{buildroot}%{_sysconfdir}/containers/registries.conf.d
-install -Dp -m0644 policy.json -t %{buildroot}%{_sysconfdir}/containers
-install -Dp -m0644 RPM-GPG-KEY-redhat-release -t %{buildroot}%{_sysconfdir}/pki/rpm-gpg
-install -Dp -m0644 registry.access.redhat.com.yaml -t %{buildroot}%{_sysconfdir}/containers/registries.d
-install -Dp -m0644 registry.redhat.io.yaml -t %{buildroot}%{_sysconfdir}/containers/registries.d
-
-# install manpages
-for FILE in $(ls -a man5 | grep 5); do
-    install -Dp -m0644 man5/$FILE -t %{buildroot}%{_mandir}/man5
-done
-
-# install config files for mounts, containers and seccomp
-install -m0644 mounts.conf %{buildroot}%{_datadir}/containers/mounts.conf
-install -m0644 seccomp.json %{buildroot}%{_datadir}/containers/seccomp.json
-install -m0644 containers.conf %{buildroot}%{_datadir}/containers/containers.conf
-
-# install secrets patch directory
-install -d -p -m 755 %{buildroot}/%{_datadir}/rhel/secrets
-# rhbz#1110876 - update symlinks for subscription management
-ln -s %{_sysconfdir}/pki/entitlement %{buildroot}%{_datadir}/rhel/secrets/etc-pki-entitlement
-ln -s %{_sysconfdir}/rhsm %{buildroot}%{_datadir}/rhel/secrets/rhsm
-ln -s %{_sysconfdir}/yum.repos.d/redhat.repo %{buildroot}%{_datadir}/rhel/secrets/redhat.repo
-
-%post
-if [[ ! -f %{_mandir}/man5/Dockerfile.5.gz ]]; then
-    echo .so %{_mandir}/man5/Containerfile.5 > %{_mandir}/man5/Dockerfile.5
-    gzip %{_mandir}/man5/Dockerfile.5
-fi
-if [[ ! -f %{_mandir}/man5/dockerignore.5.gz ]]; then
-    echo .so %{_mandir}/man5/containerignore.5 > %{_mandir}/man5/dockerignore.5
-    gzip %{_mandir}/man5/dockerignore.5
-fi
-if [[ ! -f %{_mandir}/man5/.dockerignore.5.gz ]]; then
-    echo .so %{_mandir}/man5/containerignore.5 > %{_mandir}/man5/.dockerignore.5
-    gzip %{_mandir}/man5/.dockerignore.5
-fi
-
-%files
-%dir %{_sysconfdir}/containers
-%dir %{_sysconfdir}/containers/certs.d
-%dir %{_sysconfdir}/containers/oci
-%dir %{_sysconfdir}/containers/oci/hooks.d
-%dir %{_sysconfdir}/containers/registries.conf.d
-%dir %{_sysconfdir}/containers/registries.d
-%config(noreplace) %{_sysconfdir}/containers/policy.json
-%config(noreplace) %{_sysconfdir}/containers/registries.conf
-%config(noreplace) %{_sysconfdir}/containers/registries.conf.d/000-shortnames.conf
-%{_sysconfdir}/pki/rpm-gpg/RPM-GPG-KEY-redhat-release
-%config(noreplace) %{_sysconfdir}/containers/registries.d/default.yaml
-%{_sysconfdir}/containers/registries.d/registry.redhat.io.yaml
-%{_sysconfdir}/containers/registries.d/registry.access.redhat.com.yaml
-%ghost %{_sysconfdir}/containers/storage.conf
-%ghost %{_sysconfdir}/containers/containers.conf
-%dir %{_sharedstatedir}/containers/sigstore
-%ghost %{_mandir}/man5/Dockerfile.5.gz
-%ghost %{_mandir}/man5/dockerignore.5.gz
-%ghost %{_mandir}/man5/.dockerignore.5.gz
-%{_mandir}/man5/Containerfile.5.gz
-%{_mandir}/man5/containerignore.5.gz
-%{_mandir}/man5/.containerignore.5.gz
-%{_mandir}/man5/containers*.5.gz
-%dir %{_datadir}/containers
-%{_datadir}/containers/storage.conf
-%{_datadir}/containers/containers.conf
-%{_datadir}/containers/mounts.conf
-%{_datadir}/containers/seccomp.json
-%dir %{_datadir}/rhel/secrets
-%{_datadir}/rhel/secrets/*
-
-%changelog
-%autochangelog

contrib/dependabot-dance

@@ -1,114 +0,0 @@
-#! /usr/bin/env bash
-#
-# dependabot-dance - invoked to perform manual steps on podman dependabot PRs
-#
-# As best I can tell (please correct me if mistaken), dependabot's job is
-# to submit PRs with a change only in 'go.mod' but without actually
-# running 'make vendor' to update the source files under vendor. This
-# requires a human to run those steps.
-#
-# This script automates that, with a few safety checks.
-#
-ME=$(basename $0)
-missing=" argument is missing; see $ME --help for details"
-usage="Usage: $ME [--help] [-v|--verbose]
-
-$ME performs a series of magical steps to get dependabot PRs
-ready for merge. The important one is 'make vendor-in-container',
-everything else is scaffolding to check out the PR and push it back.
-
-Flags:
-  --help          display usage message
-  -v, --verbose   verbose output
-"
-
-verbose=
-for i
-do
-    value=$(expr "$i" : '[^=]*=\(.*\)')
-    case "$i" in
-    -h*|--help)	echo "$usage"; exit 0;;
-    -v|--verbose)	verbose=$i; shift;;
-    -*)	echo "$ME: unrecognized option $i" >&2
-	echo "$usage" >&2
-	exit 1;;
-    *)	break;;
-    esac
-done
-
-die () {
-    echo "$ME: $*" >&2
-    exit 1
-}
-
-function branch_dance() {
-    local branch="$1"
-
-    # User will appreciate seeing 'git' and 'make' commands, but nothing else
-    set -x
-    git checkout -t $branch
-    set +x
-
-    # Commit must be from dependabot
-    author=$(git show --no-patch --format='format:%an' HEAD)
-    if ! [[ $author =~ dependabot ]]; then
-        echo
-        echo "Commit author is '$author' (expected 'dependabot')"
-        echo -n "Continue? [y/N] "
-        read answer
-        case "$answer" in
-            [yY]*) ;;
-            *) exit 1;;
-        esac
-    fi
-
-    # This is what does all the work
-    set -x
-    make vendor-in-container
-    set +x
-
-    # Now make sure at least *something* changed under vendor
-    modified=$(git ls-files -m vendor)
-    if [[ -z "$modified" ]]; then
-        echo "No files changed under 'vendor' -- nothing to do!"
-        return
-    fi
-
-    # Okay, here we go
-    set -x
-    git add vendor
-    git commit -a --amend -s --no-edit
-    git push --force
-    set +x
-
-    # Try to leave things in relatively clean state; remove local branch copy
-    local tracking_branch=$(git branch --show-current)
-    git checkout main
-    git branch -d $tracking_branch
-}
-
-
-
-
-# Make sure we're cd'ed to the top level of a podman repo
-test -d .git || die "No .git subdirectory (please cd to top level)"
-
-# Clear all dependabot remote branches
-git branch -r | grep /dependabot/go_modules/ \
-    | xargs --no-run-if-empty git branch -r -d
-
-# ...and pull new ones
-git pull --all
-
-# Abort on any error from here on
-set -e
-
-# We cannot have any git-modified files
-modified=$(git ls-files -m)
-test -z "$modified" || die "Modified files exist: $modified"
-
-for branch in $(git branch -r | grep /dependabot/go_modules/); do
-    echo
-    echo ">>>>> $branch"
-    branch_dance $branch
-done

contrib/dependencies.txt

@@ -1,32 +0,0 @@
-# Fedora dependencies for building podman
-
-btrfs-progs-devel
-bzip2
-containernetworking-cni
-device-mapper-devel
-findutils
-git
-glib2-devel
-glibc-static
-golang
-gpgme-devel
-iptables
-libassuan-devel
-libseccomp-devel
-libselinux-devel
-lsof
-make
-nmap-ncat
-procps-ng
-python
-python3-dateutil
-python3-pip
-python3-psutil
-python3-pytoml
-python3-pyyaml
-rsync
-slirp4netns
-unzip
-which
-xz
-zip

contrib/modules-load.d/podman-iptables.conf

@@ -1,5 +0,0 @@
-# On fedora 36 ip_tables is no longer auto loaded and rootless user have no permsissions to load it.
-# When we have actual nftables support in the future we might want to revisit this.
-# If you use iptables-nft this is not needed.
-ip_tables
-ip6_tables

contrib/pkginstaller/Makefile

@@ -9,7 +9,7 @@ else
 endif
 GVPROXY_VERSION=$(shell $(GO) list -m -f '{{.Version}}' github.com/containers/gvisor-tap-vsock)
 VFKIT_VERSION ?= 0.6.1
-KRUNKIT_VERSION ?= 0.2.0
+KRUNKIT_VERSION ?= 0.2.2
 GVPROXY_RELEASE_URL ?= https://github.com/containers/gvisor-tap-vsock/releases/download/$(GVPROXY_VERSION)/gvproxy-darwin
 VFKIT_RELEASE_URL ?= https://github.com/crc-org/vfkit/releases/download/v$(VFKIT_VERSION)/vfkit-unsigned
 KRUNKIT_RELEASE_URL ?= https://github.com/containers/krunkit/releases/download/v$(KRUNKIT_VERSION)/krunkit-podman-unsigned-$(KRUNKIT_VERSION).tgz

contrib/podman-next/fcos-podmanimage/Containerfile

@@ -1,21 +0,0 @@
-FROM quay.io/fedora/fedora-coreos:stable
-
-# Setup the podman-next copr repo
-# The source file for the dnf repo may say `rawhide` but it's release
-# agnostic and `rawhide` in the name is unlikely to change compared
-# with URLs containing fedora release numbers.
-ADD https://copr.fedorainfracloud.org/coprs/rhcontainerbot/podman-next/repo/fedora-rawhide/rhcontainerbot-podman-next-fedora-rawhide.repos /etc/yum.repos.d/rhcontainerbot-podman-next-fedora.repo
-ADD https://download.copr.fedorainfracloud.org/results/rhcontainerbot/podman-next/pubkey.gpg /etc/pki/rpm-gpg/rhcontainerbot-podman-next-fedora.gpg
-
-# Replace aardvark-dns, containers-common[-extra], crun, netavark, podman
-# Install crun-wasm and wasmedge-rt
-# Remove moby-engine, containerd, runc
-# Note: Currently does not result in a size reduction for the container image
-RUN rpm-ostree override replace --experimental --freeze \
-    --from repo="copr:copr.fedorainfracloud.org:rhcontainerbot:podman-next" \
-    aardvark-dns containers-common containers-common-extra crun crun-wasm netavark podman && \
-    rpm-ostree install wasmedge-rt && \
-    rpm-ostree override remove moby-engine containerd runc && \
-    ostree container commit
-
-LABEL quay.expires-after=30d

contrib/remote/containers.conf

@@ -1,11 +0,0 @@
-# The container's configuration file specifies all of the available configuration
-# command-line options/flags for container engine tools like Podman
-# but in a TOML format that can be easily modified and versioned.
-
-[engine]
-
-# Default Remote URI to access the Podman service.
-# Examples:
-#  remote rootless ssh://engineering.lab.company.com/run/user/1000/podman/podman.sock
-#  remote rootful ssh://root@10.10.1.136:22/run/podman/podman.sock
-# remote_uri= ""

contrib/script/size.sh

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-: "${GOPATH?Need to set GOPATH}"
-
-cd cmd/podman/ && eval `go build -work -a 2>&1` && find $WORK -type f -name "*.a" | xargs -I{} du -hxs "{}" | sort -rh | sed -e s:${WORK}/::g

contrib/snapcraft/.gitignore

@@ -1,12 +0,0 @@
-#snapcraft specifics
-/parts/
-/stage/
-/prime/
-
-*.snap
-
-.snapcraft
-__pycache__
-*.pyc
-*_source.tar.bz2
-snap/.snapcraft

contrib/snapcraft/README.md

@@ -1,82 +0,0 @@
-<h1 align="center">
-  <img src="https://raw.githubusercontent.com/containers/podman.io/main/images/podman.svg?sanitize=true" alt="podman">
-  <br />
-</h1>
-
-<p align="center"><b>This is the snap for <a href="https://podman.io/">podman</a></b>, <i>“Managing Pods, Containers, and Container Images in Multiple Formats (Docker, OCI, ...).”</i>. It works on Ubuntu, Fedora, Debian, RHEL, SUSE, and other major Linux
-distributions.</p>
-
-<!-- Uncomment and modify this when you are provided a build status badge
-<p align="center">
-<a href="https://build.snapcraft.io/user/snapcrafters/fork-and-rename-me"><img src="https://build.snapcraft.io/badge/snapcrafters/fork-and-rename-me.svg" alt="Snap Status"></a>
-</p>
--->
-
-<!-- Uncomment and modify this when you have a screenshot
-![podman](screenshot.png?raw=true "podman")
--->
-
-<p align="center">Published for <img src="https://raw.githubusercontent.com/anythingcodes/slack-emoji-for-techies/gh-pages/emoji/tux.png" align="top" width="24" /> with 💝 by Snapcrafters</p>
-
-## Install
-
-    sudo snap install podman
-
-([Don't have snapd installed?](https://snapcraft.io/docs/core/install))
-
-## Remaining tasks
-<!-- Uncomment and modify this when you have a screenshot
-![podman](screenshot.png?raw=true "podman")
--->
-
-Snapcrafters ([join us](https://forum.snapcraft.io/t/join-snapcrafters/1325))
-are working to land snap install documentation and
-the [snapcraft.yaml](https://github.com/snapcrafters/podman/blob/main/snap/snapcraft.yaml)
-upstream so `podman` can authoritatively publish future releases.
-
-  - [x] Fork the [Snapcrafters template](https://github.com/snapcrafters/fork-and-rename-me) repository to your own GitHub account.
-    - If you have already forked the Snapcrafter template to your account and want to create another snap, you'll need to use GitHub's [Import repository](https://github.com/new/import) feature because you can only fork a repository once.
-  - [x] Rename the forked Snapcrafters template repository
-  - [x] Update the description of the repository
-  - [x] Update logos and references to `podman` and `[podman]`
-  - [ ] Create a snap that runs in `devmode`
-  - [x] Register the snap in the store, **using the preferred upstream name**
-  - [ ] Add a screenshot to this `README.md`
-  - [ ] Publish the `devmode` snap in the Snap store edge channel
-  - [ ] Add install instructions to this `README.md`
-  - [ ] Update snap store metadata, icons and screenshots
-  - [ ] Convert the snap to `strict` confinement, or `classic` confinement if it qualifies
-  - [ ] Publish the confined snap in the Snap store beta channel
-  - [ ] Update the install instructions in this `README.md`
-  - [ ] Post a call for testing on the [Snapcraft Forum](https://forum.snapcraft.io) - [link]()
-  - [ ] Make a post in the [Snapcraft Forum](https://forum.snapcraft.io) asking for a transfer of the snap name from you to snapcrafters - [link]()
-  - [ ] Ask a [Snapcrafters admin](https://github.com/orgs/snapcrafters/people?query=%20role%3Aowner) to fork your repo into github.com/snapcrafters, and configure the repo for automatic publishing into edge on commit
-  - [ ] Add the provided Snapcraft build badge to this `README.md`
-  - [ ] Publish the snap in the Snap store stable channel
-  - [ ] Update the install instructions in this `README.md`
-  - [ ] Post an announcement in the [Snapcraft Forum](https://forum.snapcraft.io) - [link]()
-  - [ ] Submit a pull request or patch upstream that adds snap install documentation - [link]()
-  - [ ] Submit a pull request or patch upstream that adds the `snapcraft.yaml` and any required assets/launchers - [link]()
-  - [ ] Add upstream contact information to the `README.md`
-  - If upstream accept the PR:
-    - [ ] Request upstream create a Snap store account
-    - [ ] Contact the Snap Advocacy team to request the snap be transferred to upstream
-  - [ ] Ask the Snap Advocacy team to celebrate the snap - [link]()
-
-If you have any questions, [post in the Snapcraft forum](https://forum.snapcraft.io).
-
-<!--
-## The Snapcrafters
-
-| [![Your Name](https://gravatar.com/avatar/bc0bced65e963eb5c3a16cab8b004431/?s=128)](https://github.com/yourname/) |
-| :---: |
-| [Your Name](https://github.com/yourname/) |
--->
-
-<!-- Uncomment and modify this when you have upstream contacts
-## Upstream
-
-| [![Upstream Name](https://gravatar.com/avatar/bc0bced65e963eb5c3a16cab8b004431?s=128)](https://github.com/upstreamname) |
-| :---: |
-| [Upstream Name](https://github.com/upstreamname) |
--->

contrib/snapcraft/snap/snapcraft.yaml

@@ -1,45 +0,0 @@
-name: podman # you probably want to 'snapcraft register <name>'
-version: '0.11.1.1' # just for humans, typically '1.2+git' or '1.3.2'
-summary: Manage pods, containers and container images
-description: |
-  `podman` is a tool for managing Pods, Containers, and Container Images
-  in multiple formats including Docker/OSI images. It exposes the same
-  command line interface as Docker, but runs containers unprivileged by
-  default.
-
-confinement: devmode # use 'strict' once you have the right plugs and slots
-
-base: core18
-
-parts:
-  podman:
-    plugin: go
-    source: https://github.com/containers/podman/archive/v0.11.1.1.tar.gz
-    go-importpath: github.com/containers/podman
-    build-packages:
-     # https://podman.io/getting-started/installation#build-and-run-dependencies
-     - btrfs-tools
-     - git
-     - golang-go
-     - go-md2man
-     - iptables
-     - libassuan-dev
-     - libdevmapper-dev
-     - libglib2.0-dev
-     - libc6-dev
-     - libgpgme11-dev
-     - libgpg-error-dev
-     - libostree-dev
-     - libprotobuf-dev
-     - libprotobuf-c0-dev
-     - libseccomp-dev
-     - libselinux1-dev
-     - pkg-config
-    stage-packages:
-     - libarchive13
-     - libassuan0
-     - libgpgme11
-     - libicu60
-     - libostree-1-1
-     - libsoup2.4-1
-     - libxml2

contrib/validatepr/Containerfile

@@ -3,15 +3,15 @@ FROM registry.fedoraproject.org/fedora:latest
 WORKDIR /go/src/github.com/containers/podman
 
 RUN dnf install -y systemd-devel \
+	awk \
+	btrfs-progs-devel \
+	git \
+	golang \
+	gpgme-devel \
 	libassuan-devel \
 	libseccomp-devel \
-	gpgme-devel \
-	device-mapper-devel \
-	btrfs-progs-devel \
-	golang \
 	make \
 	man-db \
-	git \
 	perl-Clone \
 	perl-FindBin \
-	pre-commit  && dnf clean all
+	pre-commit && dnf clean all

contrib/win-installer/build-hooks.ps1

@@ -1,67 +0,0 @@
-function Build-WSLKernelInstaller {
-    param (
-        [string]$wslkerninstFolder,
-        [string]$artifactsFolder
-        );
-    Set-Variable GOARCH=amd64
-    go build -ldflags -H=windowsgui -o "$artifactsFolder\podman-wslkerninst.exe" "$wslkerninstFolder"
-}
-
-function Build-MSIHooks {
-    param (
-        [string]$msiHooksFolder,
-        [string]$artifactsFolder
-        );
-
-    # Build using x86 toolchain, see comments in check.c for rationale and details
-    if ( Get-MingW ) {
-        Build-MSIHooks-Using-MingW $msiHooksFolder $artifactsFolder
-    } elseif ( Get-VSBuildTools ) {
-        $vsinstance = Get-VSSetupInstance | Select-VSSetupInstance -Product  Microsoft.VisualStudio.Product.BuildTools -Latest
-        Build-MSIHooks-Using-VSBuildTools $msiHooksFolder $artifactsFolder $vsinstance
-    } else {
-        $msg = "A C/C++ compiler is required to build `"$msiHooksFolder\check.c`". "
-        $msg += "Supported compilers are MinGW CC (`"x86_64-w64-mingw32-gcc`") and the "
-        $msg += "`"Microsoft.VisualStudio.Product.BuildTools`" with `"VSSetup`" PowerShell extension."
-        Write-Error -Message $msg -ErrorAction Stop
-    }
-}
-
-function Get-MingW {
-    return Get-Command "x86_64-w64-mingw32-gcc" -errorAction SilentlyContinue
-}
-
-function Get-VSBuildTools {
-    return ((Get-Command "Get-VSSetupInstance" -errorAction SilentlyContinue) -and `
-            (@(Get-VSSetupInstance | Select-VSSetupInstance -Product "Microsoft.VisualStudio.Product.BuildTools").Count -gt 0))
-}
-
-function Build-MSIHooks-Using-MingW {
-    param (
-        [string]$msiHooksFolder,
-        [string]$artifactsFolder
-        );
-    Set-Variable GOARCH=amd64
-    x86_64-w64-mingw32-gcc $msiHooksFolder/check.c -shared -lmsi -mwindows -o $artifactsFolder/podman-msihooks.dll
-}
-
-function Build-MSIHooks-Using-VSBuildTools {
-    param (
-        [string]$msiHooksFolder,
-        [string]$artifactsFolder,
-        [Microsoft.VisualStudio.Setup.Instance]$vsinstance
-        );
-    $vspath = $vsinstance.InstallationPath
-    $vsinstanceid = $vsinstance.InstanceId
-
-    Import-Module "$vspath\Common7\Tools\Microsoft.VisualStudio.DevShell.dll"
-    Enter-VsDevShell $vsinstanceid -DevCmdArguments '-arch=amd64 -host_arch=amd64'
-    cl.exe /W4 /Fo$artifactsFolder\ $msiHooksFolder\check.c Advapi32.lib Msi.lib /link /DLL /out:$artifactsFolder\podman-msihooks.dll
-}
-
-$wslkerninstFolder="$PSScriptRoot\..\..\cmd\podman-wslkerninst"
-$msiHooksFolder="$PSScriptRoot\podman-msihooks"
-$artifactsFolder="$PSScriptRoot\artifacts"
-
-Build-WSLKernelInstaller $wslkerninstFolder $artifactsFolder
-Build-MSIHooks $msiHooksFolder $artifactsFolder

contrib/win-installer/build.ps1

@@ -55,6 +55,7 @@ if ($args.Count -lt 1 -or $args[0].Length -lt 1) {
     Write-Host 'Uses Env Vars: '
     Write-Host '   $ENV:FETCH_BASE_URL - GitHub Repo Address to locate release on'
     Write-Host '   $ENV:V531_SETUP_EXE_PATH - Path to v5.3.1 setup.exe used to build the patch'
+    Write-Host '   $ENV:PODMAN_ARCH - Installer target platform (x64 or arm64)'
     Write-Host 'Env Settings for signing (optional)'
     Write-Host '   $ENV:VAULT_ID'
     Write-Host '   $ENV:APP_ID'
@@ -103,11 +104,18 @@ if ($ENV:INSTVER -eq "") {
     Exit 1
 }
 
-.\build-hooks.ps1; ExitOnError
+$installerPlatform = ""
+if ($null -eq $ENV:PODMAN_ARCH -or "" -eq $ENV:PODMAN_ARCH -or "amd64" -eq $ENV:PODMAN_ARCH) {
+    $installerPlatform = "x64"
+} elseif ($ENV:PODMAN_ARCH -eq "arm64") {
+    $installerPlatform = "arm64"
+} else {
+    Write-Host "Unknown architecture $ENV:PODMAN_ARCH. Valid options are amd64 or arm64."
+    Exit 1
+}
+
 SignItem @("artifacts/win-sshproxy.exe",
-          "artifacts/podman.exe",
-          "artifacts/podman-msihooks.dll",
-          "artifacts/podman-wslkerninst.exe")
+          "artifacts/podman.exe")
 $gvExists = Test-Path "artifacts/gvproxy.exe"
 if ($gvExists) {
     SignItem @("artifacts/gvproxy.exe")
@@ -126,10 +134,10 @@ if ($gvExists) {
 if (Test-Path ./obj) {
     Remove-Item ./obj -Recurse -Force -Confirm:$false
 }
-dotnet build podman.wixproj /property:DefineConstants="VERSION=$ENV:INSTVER" -o .; ExitOnError
+dotnet build podman.wixproj /property:DefineConstants="VERSION=$ENV:INSTVER" /property:InstallerPlatform="$installerPlatform" -o .; ExitOnError
 SignItem @("en-US\podman.msi")
 
-dotnet build podman-setup.wixproj /property:DefineConstants="VERSION=$ENV:INSTVER" -o .; ExitOnError
+dotnet build podman-setup.wixproj /property:DefineConstants="VERSION=$ENV:INSTVER" /property:InstallerPlatform="$installerPlatform" -o .; ExitOnError
 wix burn detach podman-setup.exe -engine engine.exe; ExitOnError
 SignItem @("engine.exe")
 

contrib/win-installer/podman-msihooks/check.c

@@ -1,130 +0,0 @@
-#include <windows.h>
-#include <MsiQuery.h>
-
-BOOL isWSLEnabled();
-BOOL isHyperVEnabled();
-LPCWSTR boolToNStr(BOOL bool);
-LPCSTR szSvcNameHyperv = TEXT("vmms");
-
-/**
- * CheckWSL is a custom action loaded by the Podman Windows installer
- * to determine whether the system already has WSL installed.
- *
- * The intention is that this action is compiled for x86_64, which
- * can be ran on both Intel and Arm based systems (the latter through
- * emulation). While the code should build fine on MSVC and clang, the
- * intended usage is MingW-W64 (cross-compiling gcc targeting Windows).
- *
- * Previously this was implemented as a Golang c-shared cgo library,
- * however, the WoW x86_64 emulation layer struggled with dynamic
- * hot-loaded transformation of the goruntime into an existing process
- * (required by MSI custom actions). In the future this could be
- * converted back, should the emulation issue be resolved.
- */
-
- __declspec(dllexport) UINT __cdecl CheckWSL(MSIHANDLE hInstall) {
-	BOOL hasWSL = isWSLEnabled();
-	// Set a property with the WSL state for the installer to operate on
-	MsiSetPropertyW(hInstall, L"HAS_WSLFEATURE", boolToNStr(hasWSL));
-
-	return 0;
-}
-
-/**
- * CheckHyperV is a custom action loaded by the Podman Windows installer
- * to determine whether the system already has Hyper-V installed.
- */
-
- __declspec(dllexport) UINT __cdecl CheckHyperV(MSIHANDLE hInstall) {
-	BOOL hasHyperV = isHyperVEnabled();
-	// Set a property with the HyperV state for the installer to operate on
-	MsiSetPropertyW(hInstall, L"HAS_HYPERVFEATURE", boolToNStr(hasHyperV));
-
-	return 0;
-}
-
-LPCWSTR boolToNStr(BOOL bool) {
-	return bool ? L"1" : L"0";
-}
-
-BOOL isWSLEnabled() {
-	/*
-	 * The simplest, and most reliable check across all variants and versions
-	 * of WSL appears to be changing the default version to WSL 2 and check
-	 * for errors, which we need to do anyway.
-	 */
-	STARTUPINFOW startup;
-	PROCESS_INFORMATION process;
-
-	ZeroMemory(&startup, sizeof(STARTUPINFOW));
-	startup.cb = sizeof(STARTUPINFOW);
-
-	// These settings hide the console window, so there is no annoying flash
-	startup.dwFlags = STARTF_USESHOWWINDOW;
-	startup.wShowWindow = SW_HIDE;
-
-	// CreateProcessW requires lpCommandLine to be mutable
-	wchar_t cmd[] = L"wsl --set-default-version 2";
-	if (! CreateProcessW(NULL, cmd, NULL, NULL, FALSE, CREATE_NEW_CONSOLE,
-						 NULL, NULL, &startup, &process)) {
-
-		return FALSE;
-	}
-
-	DWORD exitCode;
-	WaitForSingleObject(process.hProcess, INFINITE);
-	if (! GetExitCodeProcess(process.hProcess, &exitCode)) {
-		return FALSE;
-	}
-
-	return exitCode == 0;
-}
-
-BOOL isHyperVEnabled() {
-	/*
-	 * Checks if the Windows service `vmms` is running to
-	 * determine if Hyper-V is enabled.
-	 */
-	SC_HANDLE schSCManager;
-	SC_HANDLE schService;
-	SERVICE_STATUS_PROCESS ssStatus;
-	DWORD dwBytesNeeded;
-
-	// Get a handle to the SCM database.
-	schSCManager = OpenSCManager(
-		NULL,                    // local computer
-		NULL,                    // servicesActive database
-		SERVICE_QUERY_STATUS);   // service query access rights
-
-	if (NULL == schSCManager) {
-		return FALSE;
-	}
-
-	// Get a handle to the service.
-	schService = OpenService(
-		schSCManager,
-		szSvcNameHyperv,
-		SERVICE_QUERY_STATUS);
-
-	if (schService == NULL) {
-		CloseServiceHandle(schSCManager);
-		return FALSE;
-	}
-
-	// Check the status
-	if (!QueryServiceStatusEx(
-			schService,                     // handle to service
-			SC_STATUS_PROCESS_INFO,         // information level
-			(LPBYTE) &ssStatus,             // address of structure
-			sizeof(SERVICE_STATUS_PROCESS), // size of structure
-			&dwBytesNeeded ) ) {
-		CloseServiceHandle(schService);
-		CloseServiceHandle(schSCManager);
-		return FALSE;
-	}
-
-	CloseServiceHandle(schService);
-	CloseServiceHandle(schSCManager);
-
-	return ssStatus.dwCurrentState == SERVICE_RUNNING;
-}

contrib/win-installer/podman-setup.wixproj

@@ -1,6 +1,5 @@
 <Project Sdk="WixToolset.Sdk/5.0.2">
     <PropertyGroup>
-		<InstallerPlatform>x64</InstallerPlatform>
 		<EnableDefaultCompileItems>false</EnableDefaultCompileItems>
 		<OutputType>Bundle</OutputType>
 	</PropertyGroup>

contrib/win-installer/podman.wixproj

@@ -1,6 +1,5 @@
 <Project Sdk="WixToolset.Sdk/5.0.2">
 	<PropertyGroup>
-		<InstallerPlatform>x64</InstallerPlatform>
 		<EnableDefaultCompileItems>false</EnableDefaultCompileItems>
 	</PropertyGroup>
 	<ItemGroup>

contrib/win-installer/podman.wxs

@@ -51,9 +51,7 @@
 		-->
 		<SetProperty Id="HIDE_PROVIDER_CHOICE" After="AppSearch" Value="1" Sequence="first" Condition="(SKIP_CONFIG_FILE_CREATION = 1) OR (MACHINE_PROVIDER_CONFIG_FILE_PATH) OR (MAIN_EXECUTABLE_FILE_PATH)" />
 
-		<CustomAction Id="OpenGuide" DllEntry="WixShellExec" Impersonate="yes" BinaryRef="Wix4UtilCA_X86" />
-		<CustomAction Id="CheckWSL" Execute="firstSequence" DllEntry="CheckWSL" BinaryRef="PodmanHooks" />
-		<CustomAction Id="CheckHyperV" Execute="firstSequence" DllEntry="CheckHyperV" BinaryRef="PodmanHooks" />
+		<CustomAction Id="OpenGuide" DllEntry="WixShellExec" Impersonate="yes" BinaryRef="Wix4UtilCA_$(sys.BUILDARCHSHORT)" />
 		<util:BroadcastEnvironmentChange />
 		<Feature Id="Complete" Level="1">
 			<ComponentRef Id="INSTALLDIR_Component" />
@@ -82,12 +80,6 @@
 			<Publish Dialog="ExitDialog" Control="Finish" Event="DoAction" Value="OpenGuide" Condition="(WIXUI_EXITDIALOGOPTIONALCHECKBOX = 1) AND (NOT Installed) AND (NOT UpdateStarted)" />
 		</UI>
 
-		<InstallExecuteSequence>
-			<Custom Action="CheckWSL" Before="InstallFiles" />
-			<Custom Action="CheckHyperV" Before="InstallFiles" />
-		</InstallExecuteSequence>
-		<Binary Id="PodmanHooks" SourceFile="artifacts/podman-msihooks.dll" />
-
 		<StandardDirectory Id="ProgramFiles6432Folder">
 			<Directory Id="RedHatPFiles" Name="RedHat">
 				<Directory Id="INSTALLDIR" Name="Podman">

contrib/win-installer/process-release.ps1

@@ -97,10 +97,14 @@ try {
     $restore = 1
     $ProgressPreference = 'SilentlyContinue';
 
+    if ($null -eq $ENV:PODMAN_ARCH -or "" -eq $ENV:PODMAN_ARCH ) {
+        Write-Warning "PODMAN_ARCH not set, defaulting to amd64"
+        $ENV:PODMAN_ARCH = "amd64"
+    }
     if ($releaseDir.Length -gt 0) {
-        Copy-Item -Path "$releaseDir/podman-remote-release-windows_amd64.zip" "release.zip"
+        Copy-Item -Path "$releaseDir/podman-remote-release-windows_${ENV:PODMAN_ARCH}.zip" "release.zip"
     } else {
-        DownloadOrSkip "$base_url/releases/download/$version/podman-remote-release-windows_amd64.zip"  "release.zip"
+        DownloadOrSkip "$base_url/releases/download/$version/podman-remote-release-windows_${ENV:PODMAN_ARCH}.zip"  "release.zip"
         DownloadOptional "$base_url/releases/download/$version/shasums" ..\shasums
     }
     Expand-Archive -Path release.zip

docker/podman-docker.sh

@@ -1,7 +1,7 @@
 # DOCKER_HOST initialization
 
 if [ -z "${DOCKER_HOST-}" ]; then
-    if [ $(id -u) -eq 0 ]; then
+    if [ "$(id -u)" -eq 0 ]; then
 	export DOCKER_HOST=unix:///run/podman/podman.sock
     else
 	if [ -n "${XDG_RUNTIME_DIR-}" ]; then

docs/CODE_STRUCTURE.md

@@ -0,0 +1,89 @@
+# Podman Codebase structure
+
+Description about important directories in our repository.
+
+### bin/
+
+- Build binaries are put here, podman, podman-remote, quadlet, etc...
+
+### cmd/
+
+ - Each directory here builds its own binary.
+
+#### cmd/podman/
+
+- Podman CLI code, CLI commands and flags are defined here, we are using the [Cobra CLI library](https://github.com/spf13/cobra) for command line parsing.
+
+#### cmd/quadlet/
+
+- Quadlet CLI code.
+
+### contrib/
+
+- CI scripts, packaging files some container image build files.
+
+### docs/
+
+- Sphinx based documentation for Podman that is build on [Read the Docs](https://readthedocs.com/) and hosted at [docs.podman.io](https://docs.podman.io/).
+- More information is found in [README.md](./README.md).
+
+### libpod/ (only works on linux and freebsd)
+- Underlying core for most Podman operations, defines container, pod, volume management operations.
+- Contains the database to store these information on disk, either Sqlite or Botldb (our old db format).
+- Integrates with our other libraries such as:
+	- containers/storage to create and mount container storage.
+	- containers/buildah for building images.
+	- containers/common/libnetwork for network management.
+
+### pkg/
+
+- Various packages to do all sorts of different things.
+
+#### pkg/api/
+
+- The HTTP REST API server code.
+
+#### pkg/bindings/
+
+- The HTTP REST API client code.
+- This package must have a stable API as it is for use by external consumers as well.
+
+#### pkg/domain/
+
+- "glue" code between cli and the actual operations performed.
+
+##### pkg/domain/entities/
+
+- The package defines two interfaces (ContainerEngine, ImageEngine) that more or less have a function for each cli command defined.
+- It also defines a lot of types (structs) for the various options the functions accept.
+
+##### pkg/domain/infra/tunnel/
+
+- Implements the two interfaces for the remote mode (podman-remote) which just maps each operations to the bindings code from pkg/bindings which then talks to the remote server.
+
+##### pkg/domain/infra/abi/
+
+- Implements the two interfaces for the local mode (podman) that calls then directly into the core parts of libpod/ or our other libraries containers/{common,image,storage}...
+
+#### pkg/libartifact/
+
+- Core code for the new podman artifact commands.
+
+#### pkg/machine/
+
+- Core code for podman machine commands.
+
+##### pkg/machine/e2e/
+
+- e2e tests for podman machine commands.
+- Runs on Windows, MacOS and Linux.
+
+### test/
+
+- Various tests suites, see the test [README.md](../test/README.md) for more details.
+- These run on linux only.
+
+### vendor/
+
+- Directory created with "go mod vendor".
+- This includes all go deps in our repo, DO NOT edit this directory directly, changes in dependencies must be made in their respective upstream repositories and then updated in go.mod.

docs/Containerfile

@@ -0,0 +1,21 @@
+# The resulting image can be used to generate podman-remote documentation.
+#
+# The CMD expects that the podman git repository is bind mounted to /podman.
+# The generated documentation will be copied to ./docs/build/remote/.
+#
+# Example usage:
+#   podman build --build-arg TARGET_OS=windows -t podman-docs-generator $(pwd)/docs
+#   podman run --rm -v $(pwd):/podman podman-docs-generator
+#
+FROM docker.io/golang:latest
+ARG TARGET_OS=windows # valid values: macos, linux, windows
+RUN apt-get update && apt-get install -y pandoc man
+RUN mkdir -p /podman-copy/podman
+ENV TARGET_OS=$TARGET_OS
+WORKDIR /podman-copy/podman
+CMD echo "Copying /podman/ to /podman-copy/. It will take some time but 1) the build will be faster 2) the local bin folder won't be overridden." && \
+    cp -a /podman/ /podman-copy/ && \
+    echo "Generating docs" && make podman-remote-${TARGET_OS}-docs && \
+    echo "Copying generated docs to /podman/" && mkdir -p /podman/docs/build/ && \
+    mkdir -p /podman/docs/build/remote/ && \
+    cp -a /podman-copy/podman/docs/build/remote/${TARGET_OS}/* /podman/docs/build/remote/

docs/kubernetes_support.md

@@ -112,6 +112,7 @@ Note: **N/A** means that the option cannot be supported in a single-node Podman
 | resources\.requests                                 | ✅      |
 | lifecycle\.postStart                                | no      |
 | lifecycle\.preStop                                  | no      |
+| lifecycle\.stopSignal                               | ✅      |
 | terminationMessagePath                              | no      |
 | terminationMessagePolicy                            | no      |
 | livenessProbe                                       | ✅      |

docs/source/markdown/options/health-timeout.md

@@ -7,8 +7,7 @@
 The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the
 value can be expressed in a time format such as **1m22s**. The default value is **30s**.
 
-Note: A timeout marks the healthcheck as failed but does not terminate the running process.
-This ensures that a slow but eventually successful healthcheck does not disrupt the container
-but is still accounted for in the health status.
+Note: A timeout marks the healthcheck as failed. If the healthcheck command itself runs longer than the specified *timeout*,
+it will be sent a `SIGKILL` signal.
 
 Note: This parameter will overwrite related healthcheck configuration from the image.

docs/source/markdown/options/latest.md

@@ -1,5 +1,5 @@
 ####> This option file is used in:
-####>   podman attach, container diff, container inspect, diff, exec, init, inspect, kill, logs, mount, network reload, pause, pod inspect, pod kill, pod logs, pod rm, pod start, pod stats, pod stop, pod top, port, restart, rm, start, stats, stop, top, unmount, unpause, wait
+####>   podman attach, container diff, container inspect, diff, exec, init, inspect, kill, logs, mount, network reload, pause, pod inspect, pod kill, pod logs, pod rm, pod start, pod stats, pod stop, pod top, port, restart, rm, start, stats, stop, top, unmount, unpause, update, wait
 ####> If file is edited, make sure the changes
 ####> are applicable to all of those.
 #### **--latest**, **-l**

docs/source/markdown/options/mount.md

@@ -13,7 +13,7 @@ Options common to all mount types:
 - *src*, *source*: mount source spec for **bind**, **glob**, and **volume**.
   Mandatory for **artifact**, **bind**, **glob**, **image** and **volume**.
 
-- *dst*, *destination*, *target*: mount destination spec.
+- *dst*, *dest*, *destination*, *target*: mount destination spec.
 
 When source globs are specified without the destination directory,
 the files and directories are mounted with their complete path
@@ -32,17 +32,28 @@ Options specific to type=**artifact**:
 - *title*: If the artifact source contains multiple blobs a title can be set
   which is compared against `org.opencontainers.image.title` annotation.
 
+- *name*: This can be used to overwrite the filename we use inside the container
+  for mounting. On a single blob artifact the name is used as is if *dst* is a
+  directory and otherwise ignored. With a multi blob artifact the name will be
+  used with an index suffix `<name>-x` where x is the layer index in the artifact
+  starting with 0.
+
 The *src* argument contains the name of the artifact, which must already exist locally.
 The *dst* argument contains the target path, if the path in the container is a
-directory or does not exist the blob title (`org.opencontainers.image.title`
-annotation) will be used as filename and joined to the path. If the annotation
-does not exist the digest will be used as filename instead. This results in all blobs
-of the artifact mounted into the container at the given path.
+directory the blob title (`org.opencontainers.image.title` annotation) will be used as
+filename and joined to the path. If the annotation does not exist the digest will be
+used as filename instead. This results in all blobs of the artifact mounted into the
+container at the given path.
 
 However, if the *dst* path is an existing file in the container, then the blob will be
 mounted directly on it. This only works when the artifact contains a single blob
 or when either *digest* or *title* are specified.
 
+If the *dst* path does not already exist in the container then if the artifact contains
+a single blob it behaves like existing file case and mounts directly to that path.
+If the artifact has more than one blob it works like the existing directory case and
+mounts each blob as file within the *dst* path.
+
 Options specific to type=**volume**:
 
 - *ro*, *readonly*: *true* or *false* (default if unspecified: *false*).
@@ -89,6 +100,8 @@ Options specific to type=**tmpfs** and **ramfs**:
 
 - *tmpcopyup*: Enable copyup from the image directory at the same location to the tmpfs/ramfs. Used by default.
 
+- *noatime*: Disable updating file access times when the file is read.
+
 - *notmpcopyup*: Disable copying files from the image to the tmpfs/ramfs.
 
 - *U*, *chown*: *true* or *false* (default if unspecified: *false*). Recursively change the owner and group of the source volume based on the UID and GID of the container.

docs/source/markdown/options/network.md

@@ -27,7 +27,7 @@ Valid _mode_ values are:
 
 - **container:**_id_: Reuse another container's network stack.
 
-- **host**: Do not create a network namespace, the container uses the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
+- **host**: Use the host's network namespace for the container instead of creating an isolated namespace. Warning: This gives the container full access to abstract Unix domain sockets and to TCP/UDP sockets bound to localhost. Since these mechanisms are often used to prevent access to sensitive system services, isolating them from access by external entities, use of this option may be considered a security vulnerability.
 
 - **ns:**_path_: Path to a network namespace to join.
 

docs/source/markdown/options/userns.container.md

@@ -30,9 +30,7 @@ Valid _mode_ values are:
 
 **auto**[:_OPTIONS,..._]: automatically create a unique user namespace.
 
-* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate.
-
-  	   Example: `containers:2147483647:2147483648`.
+* `rootful mode`: The `--userns=auto` flag requires that the user name __containers__ be specified in the /etc/subuid and /etc/subgid files, with an unused range of subordinate user IDs that Podman containers are allowed to allocate.  Example: `containers:2147483647:2147483648`.
 
 * `rootless mode`: The users range from the /etc/subuid and /etc/subgid files will be used. Note running a single container without using --userns=auto will use the entire range of UIDs and not allow further subdividing. See subuid(5).
 

docs/source/markdown/options/volume.md

@@ -54,10 +54,25 @@ See examples.
 
 `Chowning Volume Mounts`
 
-By default, Podman does not change the owner and group of source volume
-directories mounted into containers. If a <<container|pod>> is created in a new
-user namespace, the UID and GID in the container may correspond to another UID
-and GID on the host.
+When a named volume is first mounted to a container, Podman
+automatically adjusts the ownership of the volume's mount point during
+container initialization. This chown operation occurs under the
+following conditions:
+
+- The volume was not used yet (has `NeedsChown` set to true)
+- The volume is empty or has not been copied up yet
+- The volume is not managed by an external volume driver
+- The volume driver is not "image"
+
+For volumes with idmapped mounts (using the `idmap` option), the
+ownership change takes into account the container's user namespace
+mappings, but the idmapped volume retains proper UID/GID mapping. For
+volumes without idmapping, the mount point is chowned to match the
+container's process user and group, mapped to the host user namespace
+if user namespace remapping is enabled.
+
+If a <<container|pod>> is created in a new user namespace, the UID and
+GID in the container may correspond to another UID and GID on the host.
 
 The `:U` suffix tells Podman to use the correct host UID and GID based on the
 UID and GID within the <<container|pod>>, to change recursively the owner and

docs/source/markdown/podman-container-checkpoint.1.md

@@ -84,10 +84,11 @@ to do the checkpoint:
 
 #### **--export**, **-e**=*archive*
 
-Export the checkpoint to a tar.gz file. The exported checkpoint can be used
-to import the *container* on another system and thus enabling container live
-migration. This checkpoint archive also includes all changes to the *container's*
-root file-system, if not explicitly disabled using **--ignore-rootfs**.
+Export the checkpoint to an archive. The archive type is specified with
+**--compress**. The exported checkpoint can be used to import the *container* on
+another system and thus enabling container live migration. This checkpoint
+archive also includes all changes to the *container's* root file-system, if not
+explicitly disabled using **--ignore-rootfs**.
 
 #### **--file-locks**
 
@@ -99,7 +100,7 @@ The default is **false**.
 
 #### **--ignore-rootfs**
 
-If a checkpoint is exported to a tar.gz file it is possible with the help of **--ignore-rootfs** to explicitly disable including changes to the root file-system into the checkpoint archive file.\
+If a checkpoint is exported to an archive it is possible with the help of **--ignore-rootfs** to explicitly disable including changes to the root file-system into the checkpoint archive file.\
 The default is **false**.\
 *IMPORTANT: This OPTION only works in combination with __--export, -e__.*
 
@@ -107,7 +108,7 @@ The default is **false**.\
 
 This OPTION must be used in combination with the **--export, -e** OPTION.
 When this OPTION is specified, the content of volumes associated with
-the *container* is not included into the checkpoint tar.gz file.\
+the *container* is not included into the checkpoint archive.\
 The default is **false**.
 
 #### **--keep**, **-k**
@@ -128,7 +129,7 @@ The default is **false**.
 #### **--pre-checkpoint**, **-P**
 
 Dump the *container's* memory information only, leaving the *container* running. Later
-operations supersedes prior dumps. It only works on `runc 1.0-rc3` or `higher`.\
+operations supersedes prior dumps.\
 The default is **false**.
 
 The functionality to only checkpoint the memory of the container and in a second
@@ -205,12 +206,12 @@ Create a checkpoint image for the container "mywebserver".
 
 Dumps the container's memory information of the latest container into an archive.
 ```
-# podman container checkpoint -P -e pre-checkpoint.tar.gz -l
+# podman container checkpoint -P -e pre-checkpoint.tar.zst -l
 ```
 
 Keep the container's memory information from an older dump and add the new container's memory information.
 ```
-# podman container checkpoint --with-previous -e checkpoint.tar.gz -l
+# podman container checkpoint --with-previous -e checkpoint.tar.zst -l
 ```
 
 Dump the container's memory information of the latest container into an archive with the specified compress method.

docs/source/markdown/podman-container-diff.1.md.in

@@ -25,7 +25,7 @@ Alter the output into a different format. The only valid format for **podman con
 
 @@option latest
 
-## EXAMPLE
+## EXAMPLES
 
 ```
 # podman container diff container1
@@ -44,6 +44,11 @@ $ podman container diff --format json container1 container2
 }
 ```
 
+```
+$ podman container diff --latest
+C /etc
+```
+
 ## SEE ALSO
 **[podman(1)](podman.1.md)**, **[podman-container(1)](podman-container.1.md)**
 

docs/source/markdown/podman-container-inspect.1.md.in

@@ -76,7 +76,7 @@ Valid placeholders for the Go template are listed below:
 In addition to normal output, display the total file size if the type is a container.
 
 
-## EXAMPLE
+## EXAMPLES
 
 Inspect the specified container and print its information in json format.
 ```

docs/source/markdown/podman-container-restore.1.md

@@ -159,7 +159,7 @@ option is ignored. Defaults to not restoring *containers* with established TCP
 connections.\
 The default is **false**.
 
-## EXAMPLE
+## EXAMPLES
 Restore the container "mywebserver".
 ```
 # podman container restore mywebserver

docs/source/markdown/podman-diff.1.md.in

@@ -25,7 +25,7 @@ Alter the output into a different format.  The only valid format for **podman di
 
 @@option latest
 
-## EXAMPLE
+## EXAMPLES
 
 Show container-modified files versus the container's image:
 ```

docs/source/markdown/podman-exec.1.md.in

@@ -88,6 +88,11 @@ Execute command as the specified user in selected container:
 $ podman exec --user root ctrID ls
 ```
 
+Execute command but do not attach to the exec session leaving the command running in the background:
+```
+$ podman exec -d ctrID find /path/to/search -name yourfile
+```
+
 ## SEE ALSO
 **[podman(1)](podman.1.md)**, **[podman-run(1)](podman-run.1.md)**
 

docs/source/markdown/podman-farm-create.1.md

@@ -13,16 +13,14 @@ Create a new farm with connections that Podman knows about which were added via
 An empty farm can be created without adding any connections to it. Add or remove
 connections from a farm via the *podman farm update* command.
 
-## EXAMPLE
+## EXAMPLES
 
-
-
-Create the specified farm:
+Create the specified farm with no connections:
 ```
 $ podman farm create farm2
 ```
 
-Create multiple farms:
+Create a farm with connections:
 ```
 $ podman farm create farm1 f37 f38
 ```

docs/source/markdown/podman-generate-spec.1.md

@@ -24,3 +24,147 @@ Output to the given file.
 #### **--name**, **-n**
 
 Rename the pod or container, so that it does not conflict with the existing entity. This is helpful when the JSON is to be used before the source pod or container is deleted.
+
+## EXAMPLES
+
+Generate Specgen JSON based on a container.
+```
+$ podman generate spec container1
+{
+ "name": "container1-clone",
+ "command": [
+  "/bin/sh"
+ ],
+ "env": {
+  "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+  "container": "podman"
+ },
+ "sdnotifyMode": "container",
+ "pidns": {
+  "nsmode": "default"
+ },
+ "utsns": {
+  "nsmode": "private"
+ },
+ "containerCreateCommand": [
+  "podman",
+  "run",
+  "--name",
+  "container1",
+  "cea2ff433c61"
+ ],
+ "init_container_type": "",
+ "image": "cea2ff433c610f5363017404ce989632e12b953114fefc6f597a58e813c15d61",
+ "ipcns": {
+  "nsmode": "default"
+ },
+ "shm_size": 65536000,
+ "shm_size_systemd": 0,
+ "selinux_opts": [
+  "disable"
+ ],
+ "userns": {
+  "nsmode": "default"
+ },
+ "idmappings": {
+  "HostUIDMapping": true,
+  "HostGIDMapping": true,
+  "UIDMap": null,
+  "GIDMap": null,
+  "AutoUserNs": false,
+  "AutoUserNsOpts": {
+   "Size": 0,
+   "InitialSize": 0,
+   "PasswdFile": "",
+   "GroupFile": "",
+   "AdditionalUIDMappings": null,
+   "AdditionalGIDMappings": null
+  }
+ },
+ "umask": "0022",
+ "cgroupns": {
+  "nsmode": "default"
+ },
+ "netns": {
+  "nsmode": "slirp4netns"
+ },
+ "Networks": null,
+ "use_image_hosts": false,
+ "resource_limits": {}
+}
+```
+
+Generate Specgen JSON based on a container. The output is single line.
+```
+$ podman generate spec --compact container1
+{"name":"container1-clone","command":["/bin/sh"],...
+```
+
+Generate Specgen JSON based on a container, writing the output to the specified file.
+```
+$ podman generate spec --filename output.json container1
+output.json
+$ cat output.json
+{
+ "name": "container1-clone",
+ "command": [
+  "/bin/sh"
+ ],
+ "env": {
+  "PATH": "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
+  "container": "podman"
+ },
+ "sdnotifyMode": "container",
+ "pidns": {
+  "nsmode": "default"
+ },
+ "utsns": {
+  "nsmode": "private"
+ },
+ "containerCreateCommand": [
+  "podman",
+  "run",
+  "--name",
+  "container1",
+  "cea2ff433c61"
+ ],
+ "init_container_type": "",
+ "image": "cea2ff433c610f5363017404ce989632e12b953114fefc6f597a58e813c15d61",
+ "ipcns": {
+  "nsmode": "default"
+ },
+ "shm_size": 65536000,
+ "shm_size_systemd": 0,
+ "selinux_opts": [
+  "disable"
+ ],
+ "userns": {
+  "nsmode": "default"
+ },
+ "idmappings": {
+  "HostUIDMapping": true,
+  "HostGIDMapping": true,
+  "UIDMap": null,
+  "GIDMap": null,
+  "AutoUserNs": false,
+  "AutoUserNsOpts": {
+   "Size": 0,
+   "InitialSize": 0,
+   "PasswdFile": "",
+   "GroupFile": "",
+   "AdditionalUIDMappings": null,
+   "AdditionalGIDMappings": null
+  }
+ },
+ "umask": "0022",
+ "cgroupns": {
+  "nsmode": "default"
+ },
+ "netns": {
+  "nsmode": "slirp4netns"
+ },
+ "Networks": null,
+ "use_image_hosts": false,
+ "resource_limits": {}
+}
+```

docs/source/markdown/podman-image-diff.1.md

@@ -23,7 +23,7 @@ The output is prefixed with the following symbols:
 
 Alter the output into a different format.  The only valid format for **podman image diff** is `json`.
 
-## EXAMPLE
+## EXAMPLES
 
 Display image differences from images parent layer:
 ```

docs/source/markdown/podman-image-mount.1.md

@@ -30,7 +30,7 @@ Mount all images.
 
 Print the mounted images in specified format (json).
 
-## EXAMPLE
+## EXAMPLES
 
 Mount multiple images. Note: In rootless mode, image mounting works only after executing the podman unshare command to enter the user namespace.
 ```

docs/source/markdown/podman-image-unmount.1.md

@@ -46,5 +46,11 @@ Unmount all images:
 ```
 podman image unmount --all
 ```
+
+Force unmount image with a given ID:
+```
+podman image unmount --force imageID
+```
+
 ## SEE ALSO
 **[podman(1)](podman.1.md)**, **[podman-image-mount(1)](podman-image-mount.1.md)**, **[podman-mount(1)](podman-mount.1.md)**

docs/source/markdown/podman-images.1.md.in

@@ -119,7 +119,7 @@ Lists only the image IDs.
 Sort by *created*, *id*, *repository*, *size* or *tag* (default: **created**)
 When sorting by *repository* it also sorts by the *tag* as second criteria to provide a stable output.
 
-## EXAMPLE
+## EXAMPLES
 
 List all non-dangling images in local storage:
 ```

docs/source/markdown/podman-init.1.md.in

@@ -24,22 +24,31 @@ Initialize all containers. Containers that have already initialized (including c
 
 @@option latest
 
-## EXAMPLE
+## EXAMPLES
 
 Initialize specified container with a given ID.
 ```
-podman init 35480fc9d568
+$ podman init 35480fc9d568
 ```
 
 Initialize specified container with a given name.
 ```
-podman init test1
+$ podman init test1
 ```
 
 Initialize the latest container. (This option is not available with the remote Podman client, including Mac and Windows (excluding WSL2) machines)
 ```
-podman init --latest
+$ podman init --latest
 ```
+
+Initialize all containers.
+```
+$ podman init --all
+9d2629dda7b9d4ca35c1fc63fa56592a08b9d5ab988b4301fddf16b623f676cc
+a9b78bcac97e131236930e3fa0be576e95ab89c96a7cb6fb1c821b772db9f623
+9db345273719c14bc254f90ef2df24779193b42d68b1364c0914ca6f76cf5e9c
+```
+
 ## SEE ALSO
 **[podman(1)](podman.1.md)**, **[podman-start(1)](podman-start.1.md)**
 

docs/source/markdown/podman-inspect.1.md.in

@@ -38,7 +38,7 @@ In addition to normal output, display the total file size if the type is a conta
 Return JSON for the specified type. Type can be 'container', 'image', 'volume', 'network', 'pod', or 'all' (default: all)
 (Only meaningful when invoked as *podman inspect*)
 
-## EXAMPLE
+## EXAMPLES
 
 Inspect the fedora image:
 ```

docs/source/markdown/podman-kube-play.1.md.in

@@ -57,6 +57,10 @@ Note: To customize the name of the infra container created during `podman kube p
 
 Note: Use the **io.podman.annotations.pids-limit/$ctrname** annotation to configure the pod's pids limit.
 
+Note: Use the **io.podman.annotations.cpuset/$ctrname** annotation to restrict a container's execution to a specific set of CPU cores. This is equivalent to the `--cpuset-cpus=number` option in podman-run(1).
+
+Note: Use the **io.podman.annotations.memory-nodes/$ctrname** annotation to restrict a container's memory allocations to a specific set of memory nodes on NUMA systems. This is equivalent to the `--cpuset-mems=nodes` option in podman-run(1).
+
 `Kubernetes PersistentVolumeClaims`
 
 A Kubernetes PersistentVolumeClaim represents a Podman named volume. Only the PersistentVolumeClaim name is required by Podman to create a volume. Kubernetes annotations can be used to make use of the available options for Podman volumes.

docs/source/markdown/podman-load.1.md

@@ -17,13 +17,6 @@ The local client further supports loading an **oci-dir** or a **docker-dir** as
 The **quiet** option suppresses the progress output when set.
 Note: `:` is a restricted character and cannot be part of the file name.
 
-
-**podman [GLOBAL OPTIONS]**
-
-**podman load [GLOBAL OPTIONS]**
-
-**podman load [OPTIONS]**
-
 ## OPTIONS
 
 #### **--help**, **-h**

docs/source/markdown/podman-machine-init.1.md.in

@@ -104,6 +104,12 @@ if there is no existing remote connection configurations.
 
 API forwarding, if available, follows this setting.
 
+#### **--swap**, **-s**=*number*
+
+Swap (in MiB). Note: 1024MiB = 1GiB.
+
+Renders a `zram-generator.conf` file with zram-size set to the value passed to --swap
+
 #### **--timezone**
 
 Set the timezone for the machine and containers.  Valid values are `local` or
@@ -193,6 +199,12 @@ Initialize a Podman machine for the specified name pulling the content from the
 $ podman machine init myvm
 ```
 
+Initialize and start a new Podman machine in one step.
+
+```
+podman machine init --now
+```
+
 Initialize the default Podman machine pulling the content from the internet defaulting to rootful mode. The default is rootless.
 ```
 $ podman machine init --rootful

docs/source/markdown/podman-machine-list.1.md.in

@@ -50,6 +50,7 @@ Valid placeholders for the Go template are listed below:
 | .RemoteUsername     | VM Username for rootless Podman           |
 | .Running            | Is machine running                        |
 | .Stream             | Stream name                               |
+| .Swap               | Allocated swap for machine               |
 | .UserModeNetworking | Whether machine uses user-mode networking |
 | .VMType             | VM type                                   |
 

docs/source/markdown/podman-machine-reset.1.md

@@ -40,6 +40,12 @@ Are you sure you want to continue? [y/N] y
 $
 ```
 
+Force reset without confirmation.
+```
+$ podman machine reset --force
+$
+```
+
 ## SEE ALSO
 **[podman(1)](podman.1.md)**, **[podman-machine(1)](podman-machine.1.md)**
 

docs/source/markdown/podman-machine-start.1.md

@@ -44,6 +44,40 @@ Suppress machine starting status output.
 Start the specified podman machine.
 ```
 $ podman machine start myvm
+Starting machine "myvm"
+This machine is currently configured in rootless mode. If your containers
+require root permissions (e.g. ports < 1024), or if you run into compatibility
+issues with non-podman clients, you can switch using the following command:
+
+	podman machine set --rootful myvm
+
+API forwarding listening on: /var/folders/my/k1kpd8ds7p938mchyb1r_4mw0000gn/T/podman/myvm-api.sock
+
+The system helper service is not installed; the default Docker API socket
+address can't be used by podman. If you would like to install it, run the following commands:
+
+        sudo /opt/homebrew/Cellar/podman/5.2.4/bin/podman-mac-helper install
+        podman machine stop myvm; podman machine start myvm
+
+You can still connect Docker API clients by setting DOCKER_HOST using the
+following command in your terminal session:
+
+        export DOCKER_HOST='unix:///var/folders/my/k1kpd8ds7p938mchyb1r_4mw0000gn/T/podman/myvm-api.sock'
+
+Machine "myvm" started successfully
+```
+
+Start with --no-info:
+```
+$ podman machine start --no-info myvm
+Starting machine "myvm"
+Machine "myvm" started successfully
+```
+
+Start with --quiet:
+```
+$ podman machine start --quiet myvm
+Machine "myvm" started successfully
 ```
 
 ## SEE ALSO